detection.wiki

Detection rules › Sublime MQL

Impersonation: Legal firm with copyright infringement notice

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages impersonating legal firms or copyright enforcement entities with extensive legal terminology, threatening language, and urgent compliance demands.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Extortion
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Message attribute
body
body.current_thread
recipients
sender
sender.email
subject
type

Rule body MQL

type.inbound
and length(body.previous_threads) == 0
and length(body.current_thread.text) < 5000
and 0 < length(body.links) < 10

// common strings in subject or base
and (
  2 of (
    strings.ilike(subject.base, '*Content*'),
    strings.ilike(subject.base, '*Compliance*'),
    strings.ilike(subject.base, '*Review*'),
    strings.ilike(subject.base, '*Legal*'),
    strings.ilike(subject.base, '*Formal*'),
    strings.ilike(subject.base, '*LLP*'),
    strings.ilike(subject.base, '*Unauthorized*'),
    strings.ilike(subject.base, '*Trademark*'),
    strings.ilike(subject.base, '*Law*'),
    strings.ilike(subject.base, '*Enforcement*'),
    strings.ilike(subject.base, '*Copyright*'),
    strings.ilike(subject.base, '*Violat*'),
    strings.ilike(subject.base, '*Intellectual*'),
    strings.ilike(subject.base, '*Concerning*'),
    strings.ilike(subject.base, '*Notice*'),
    strings.ilike(subject.base, '*Licensing*'),
    strings.ilike(subject.base, '*Clarification*'),
    strings.ilike(subject.base, '*Matter*'),
    strings.ilike(subject.base, '*Conflict*'),
    strings.ilike(subject.base, '*Ownership*'),
    strings.ilike(sender.display_name, '*Content*'),
    strings.ilike(sender.display_name, '*Copyright*'),
    strings.ilike(sender.display_name, '*Review*'),
    strings.ilike(sender.display_name, '*Legal*'),
    strings.ilike(sender.display_name, '*Investigation*'),
    strings.ilike(sender.display_name, '*LLP*'),
    strings.ilike(sender.display_name, '*Law*'),
    strings.ilike(sender.display_name, '*Intellectual*'),
    strings.ilike(sender.display_name, '*Notice*'),
    strings.ilike(sender.display_name, '*Matter*'),
    strings.ilike(sender.display_name, '*Dispute*'),
    strings.ilike(sender.display_name, '*Resolution*'),
    strings.ilike(sender.display_name, '*Advisory*'),
  )
)

// common strings in email current thread
and 15 of (
  strings.ilike(body.current_thread.text, '*copyright*'),
  strings.ilike(body.current_thread.text, '*trademark*'),
  strings.ilike(body.current_thread.text, '*inquiry*'),
  strings.ilike(body.current_thread.text, '*online*'),
  strings.ilike(body.current_thread.text, '*authorized*'),
  strings.ilike(body.current_thread.text, '*legal*'),
  strings.ilike(body.current_thread.text, '*represent*'),
  strings.ilike(body.current_thread.text, '*lawful*'),
  strings.ilike(body.current_thread.text, '*owner*'),
  strings.ilike(body.current_thread.text, '*materials*'),
  strings.ilike(body.current_thread.text, '*protected*'),
  strings.ilike(body.current_thread.text, '*infring*'),
  strings.ilike(body.current_thread.text, '*immediate*'),
  strings.ilike(body.current_thread.text, '*cessation*'),
  strings.ilike(body.current_thread.text, '*content*'),
  strings.ilike(body.current_thread.text, '*referenced*'),
  strings.ilike(body.current_thread.text, '*17 U.S.C. §*'),
  strings.ilike(body.current_thread.text, '*constitutes*'),
  strings.ilike(body.current_thread.text, '*authorization*'),
  strings.ilike(body.current_thread.text, '*removal*'),
  strings.ilike(body.current_thread.text, '*comply*'),
  strings.ilike(body.current_thread.text, '*failure*'),
  strings.ilike(body.current_thread.text, '*law firm*'),
  strings.ilike(body.current_thread.text, '*LLP*'),
  strings.ilike(body.current_thread.text, '*compliance*'),
  strings.ilike(body.current_thread.text, '*cease*'),
  strings.ilike(body.current_thread.text, '*protect*'),
  strings.ilike(body.current_thread.text, '*rights*'),
  strings.ilike(body.current_thread.text, '*penalty*'),
  strings.ilike(body.current_thread.text, '*perjury*'),
  strings.ilike(body.current_thread.text, '*holder*'),
  strings.ilike(body.current_thread.text, '*declare*'),
  strings.ilike(body.current_thread.text, '*sworn*'),
  strings.ilike(body.current_thread.text, '*affidavit*'),
  strings.ilike(body.current_thread.text, '*investigation*'),
  strings.ilike(body.current_thread.text, '*identified*'),
  strings.ilike(body.current_thread.text, '*reproduction*'),
  strings.ilike(body.current_thread.text, '*license*'),
  strings.ilike(body.current_thread.text, '*granted*'),
  strings.ilike(body.current_thread.text, '*permitting*'),
  strings.ilike(body.current_thread.text, '*evidence*'),
  strings.ilike(body.current_thread.text, '*proceedings*'),
  strings.ilike(body.current_thread.text, '*evidentiary*'),
  strings.ilike(body.current_thread.text, '*remove*'),
  strings.ilike(body.current_thread.text, '*suspend*'),
  strings.ilike(body.current_thread.text, '*discontinue*'),
  strings.ilike(body.current_thread.text, '*72 hours*'),
  strings.ilike(body.current_thread.text, '*48 hours*'),
  strings.ilike(body.current_thread.text, '*24 hours*'),
  strings.ilike(body.current_thread.text, '*proof*'),
  strings.ilike(body.current_thread.text, '*unresolved*'),
  strings.ilike(body.current_thread.text, '*accordance*'),
  strings.ilike(body.current_thread.text, '*procedures*'),
  strings.ilike(body.current_thread.text, '*interests*'),
  strings.ilike(body.current_thread.text, '*appeal*'),
  strings.ilike(body.current_thread.text, '*clarification*'),
  strings.ilike(body.current_thread.text, '*notice*'),
  strings.ilike(body.current_thread.text, '*dissemination*'),
  strings.ilike(body.current_thread.text, '*counter-notice*'),
  strings.ilike(body.current_thread.text, '*exploitation*'),
  strings.ilike(body.current_thread.text, '*remedial*'),
  strings.ilike(body.current_thread.text, '*particulars*'),
  strings.ilike(body.current_thread.text, '*fingerprint*'),
  strings.ilike(body.current_thread.text, '*confidentiality*'),
  strings.ilike(body.current_thread.text, '*assertion*'),
  strings.ilike(body.current_thread.text, '*counsel*'),
  strings.ilike(body.current_thread.text, '*privileged*'),
  strings.ilike(body.current_thread.text, '*directive*'),
)

// remove phrase from legitimate complaint
and not regex.icontains(body.current_thread.text,
                        '(?:we are passing the notice below|content has been removed|removed from our website|notice of intended action|I have not granted|I am the original creator|content you reported has been removed|complaint will be carefully reviewed|provide a list of violations|document confirming your right to act)'
)

// not copyright reports
and not regex.icontains(body.current_thread.text,
                        '(?:confirmation|received).{0,100}copyright report'
)

// verified dmca receiving/sending address
and not any([recipients.cc, recipients.to, recipients.bcc],
            any(.,
                .email.email in (
                  'dmca@vimeo.com',
                  'dmca@support.epicgames.com',
                  'takedowns@doppel.com',
                  'ipenforcement@epicgames.com'
                )
            )
)
and not strings.icontains(sender.email.domain.root_domain, 'edwinjamesip.com')

Detection logic

Scope: inbound message.

Detects messages impersonating legal firms or copyright enforcement entities with extensive legal terminology, threatening language, and urgent compliance demands.

  1. inbound message
  2. length(body.previous_threads) is 0
  3. length(body.current_thread.text) < 5000
  4. all of:
    • length(body.links) > 0
    • length(body.links) < 10
  5. at least 2 of:
    • subject.base matches '*Content*'
    • subject.base matches '*Compliance*'
    • subject.base matches '*Review*'
    • subject.base matches '*Legal*'
    • subject.base matches '*Formal*'
    • subject.base matches '*LLP*'
    • subject.base matches '*Unauthorized*'
    • subject.base matches '*Trademark*'
    • subject.base matches '*Law*'
    • subject.base matches '*Enforcement*'
    • subject.base matches '*Copyright*'
    • subject.base matches '*Violat*'
    • subject.base matches '*Intellectual*'
    • subject.base matches '*Concerning*'
    • subject.base matches '*Notice*'
    • subject.base matches '*Licensing*'
    • subject.base matches '*Clarification*'
    • subject.base matches '*Matter*'
    • subject.base matches '*Conflict*'
    • subject.base matches '*Ownership*'
    • sender.display_name matches '*Content*'
    • sender.display_name matches '*Copyright*'
    • sender.display_name matches '*Review*'
    • sender.display_name matches '*Legal*'
    • sender.display_name matches '*Investigation*'
    • sender.display_name matches '*LLP*'
    • sender.display_name matches '*Law*'
    • sender.display_name matches '*Intellectual*'
    • sender.display_name matches '*Notice*'
    • sender.display_name matches '*Matter*'
    • sender.display_name matches '*Dispute*'
    • sender.display_name matches '*Resolution*'
    • sender.display_name matches '*Advisory*'
  6. at least 15 of 68: body.current_thread.text matches any of 68 patterns
    • *copyright*
    • *trademark*
    • *inquiry*
    • *online*
    • *authorized*
    • *legal*
    • *represent*
    • *lawful*
    • *owner*
    • *materials*
    • *protected*
    • *infring*
    • *immediate*
    • *cessation*
    • *content*
    • *referenced*
    • *17 U.S.C. §*
    • *constitutes*
    • *authorization*
    • *removal*
    • *comply*
    • *failure*
    • *law firm*
    • *LLP*
    • *compliance*
    • *cease*
    • *protect*
    • *rights*
    • *penalty*
    • *perjury*
    • *holder*
    • *declare*
    • *sworn*
    • *affidavit*
    • *investigation*
    • *identified*
    • *reproduction*
    • *license*
    • *granted*
    • *permitting*
    • *evidence*
    • *proceedings*
    • *evidentiary*
    • *remove*
    • *suspend*
    • *discontinue*
    • *72 hours*
    • *48 hours*
    • *24 hours*
    • *proof*
    • *unresolved*
    • *accordance*
    • *procedures*
    • *interests*
    • *appeal*
    • *clarification*
    • *notice*
    • *dissemination*
    • *counter-notice*
    • *exploitation*
    • *remedial*
    • *particulars*
    • *fingerprint*
    • *confidentiality*
    • *assertion*
    • *counsel*
    • *privileged*
    • *directive*
  7. not:
    • body.current_thread.text matches '(?:we are passing the notice below|content has been removed|removed from our website|notice of intended action|I have not granted|I am the original creator|content you reported has been removed|complaint will be carefully reviewed|provide a list of violations|document confirming your right to act)'
  8. not:
    • body.current_thread.text matches '(?:confirmation|received).{0,100}copyright report'
  9. not:
    • any of [recipients.cc, recipients.to, recipients.bcc] where:
      • any of . where:
        • .email.email in ('dmca@vimeo.com', 'dmca@support.epicgames.com', 'takedowns@doppel.com', 'ipenforcement@epicgames.com')
  10. not:
    • sender.email.domain.root_domain contains 'edwinjamesip.com'

Inspects: body.current_thread.text, body.links, body.previous_threads, recipients.bcc, recipients.cc, recipients.to, sender.display_name, sender.email.domain.root_domain, subject.base, type.inbound. Sensors: regex.icontains, strings.icontains, strings.ilike.

Indicators matched (98)

FieldMatchValue
strings.ilikesubstring*Content*
strings.ilikesubstring*Compliance*
strings.ilikesubstring*Review*
strings.ilikesubstring*Legal*
strings.ilikesubstring*Formal*
strings.ilikesubstring*LLP*
strings.ilikesubstring*Unauthorized*
strings.ilikesubstring*Trademark*
strings.ilikesubstring*Law*
strings.ilikesubstring*Enforcement*
strings.ilikesubstring*Copyright*
strings.ilikesubstring*Violat*
86 more
strings.ilikesubstring*Intellectual*
strings.ilikesubstring*Concerning*
strings.ilikesubstring*Notice*
strings.ilikesubstring*Licensing*
strings.ilikesubstring*Clarification*
strings.ilikesubstring*Matter*
strings.ilikesubstring*Conflict*
strings.ilikesubstring*Ownership*
strings.ilikesubstring*Investigation*
strings.ilikesubstring*Dispute*
strings.ilikesubstring*Resolution*
strings.ilikesubstring*Advisory*
strings.ilikesubstring*copyright*
strings.ilikesubstring*trademark*
strings.ilikesubstring*inquiry*
strings.ilikesubstring*online*
strings.ilikesubstring*authorized*
strings.ilikesubstring*legal*
strings.ilikesubstring*represent*
strings.ilikesubstring*lawful*
strings.ilikesubstring*owner*
strings.ilikesubstring*materials*
strings.ilikesubstring*protected*
strings.ilikesubstring*infring*
strings.ilikesubstring*immediate*
strings.ilikesubstring*cessation*
strings.ilikesubstring*content*
strings.ilikesubstring*referenced*
strings.ilikesubstring*17 U.S.C. §*
strings.ilikesubstring*constitutes*
strings.ilikesubstring*authorization*
strings.ilikesubstring*removal*
strings.ilikesubstring*comply*
strings.ilikesubstring*failure*
strings.ilikesubstring*law firm*
strings.ilikesubstring*compliance*
strings.ilikesubstring*cease*
strings.ilikesubstring*protect*
strings.ilikesubstring*rights*
strings.ilikesubstring*penalty*
strings.ilikesubstring*perjury*
strings.ilikesubstring*holder*
strings.ilikesubstring*declare*
strings.ilikesubstring*sworn*
strings.ilikesubstring*affidavit*
strings.ilikesubstring*investigation*
strings.ilikesubstring*identified*
strings.ilikesubstring*reproduction*
strings.ilikesubstring*license*
strings.ilikesubstring*granted*
strings.ilikesubstring*permitting*
strings.ilikesubstring*evidence*
strings.ilikesubstring*proceedings*
strings.ilikesubstring*evidentiary*
strings.ilikesubstring*remove*
strings.ilikesubstring*suspend*
strings.ilikesubstring*discontinue*
strings.ilikesubstring*72 hours*
strings.ilikesubstring*48 hours*
strings.ilikesubstring*24 hours*
strings.ilikesubstring*proof*
strings.ilikesubstring*unresolved*
strings.ilikesubstring*accordance*
strings.ilikesubstring*procedures*
strings.ilikesubstring*interests*
strings.ilikesubstring*appeal*
strings.ilikesubstring*clarification*
strings.ilikesubstring*notice*
strings.ilikesubstring*dissemination*
strings.ilikesubstring*counter-notice*
strings.ilikesubstring*exploitation*
strings.ilikesubstring*remedial*
strings.ilikesubstring*particulars*
strings.ilikesubstring*fingerprint*
strings.ilikesubstring*confidentiality*
strings.ilikesubstring*assertion*
strings.ilikesubstring*counsel*
strings.ilikesubstring*privileged*
strings.ilikesubstring*directive*
regex.icontainsregex(?:we are passing the notice below|content has been removed|removed from our website|notice of intended action|I have not granted|I am the original creator|content you reported has been removed|complaint will be carefully reviewed|provide a list of violations|document confirming your right to act)
regex.icontainsregex(?:confirmation|received).{0,100}copyright report
[recipients.cc, recipients.to, recipients.bcc][][].email.emailmemberdmca@vimeo.com
[recipients.cc, recipients.to, recipients.bcc][][].email.emailmemberdmca@support.epicgames.com
[recipients.cc, recipients.to, recipients.bcc][][].email.emailmembertakedowns@doppel.com
[recipients.cc, recipients.to, recipients.bcc][][].email.emailmemberipenforcement@epicgames.com
strings.icontainssubstringedwinjamesip.com