detection.wiki

Detection rules › Sublime MQL

Brand impersonation: FedEx

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Impersonation of the shipping provider FedEx.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Lookalike domain, Social engineering

Event coverage

Message attribute
body.current_thread
headers.auth_summary
sender
sender.email
type

Rule body MQL

type.inbound
and (
  sender.display_name in~ ('fedex', 'fedex shipment', 'fedex tracking updates')
  or strings.ilevenshtein(sender.display_name, 'fedex') <= 1
  or regex.icontains(sender.display_name, '^Fed-?ex')
  or strings.ilike(sender.email.domain.domain, '*fedex*')
  or (
    any(ml.logo_detect(file.message_screenshot()).brands, .name == "FedEx")
    and (
      any(ml.nlu_classifier(body.current_thread.text).entities,
          .name == "request" and strings.icontains(.text, "signature")
      )
      or strings.istarts_with(body.current_thread.text, 'FedEx')
    )
  )
)
and sender.email.domain.root_domain not in~ (
  'fedex.com',
  'fedexfreight.com', // added 2026-05-08
  'cj.com', // CJ is a global affiliate marketing network
  'sedex.com', // sedex.com is not affiliated with FedEx, but is an apparent FP
  'myworkday.com',
  'billtrust.com',
  'flying-cargo.rs', // Serbian arm of Fedex (https://www.fedex.com/en-rs/customer-support.html)
  'confirmit.com', // survey/market research company
  'centercode.com' // survey company
)
and (
  not profile.by_sender().any_messages_benign
  and not profile.by_sender().solicited
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Impersonation of the shipping provider FedEx.

  1. inbound message
  2. any of:
    • sender.display_name in ('fedex', 'fedex shipment', 'fedex tracking updates')
    • sender.display_name is similar to 'fedex'
    • sender.display_name matches '^Fed-?ex'
    • sender.email.domain.domain matches '*fedex*'
    • all of:
      • any of ml.logo_detect(file.message_screenshot()).brands where:
        • .name is 'FedEx'
      • any of:
        • any of ml.nlu_classifier(body.current_thread.text).entities where all hold:
          • .name is 'request'
          • .text contains 'signature'
        • body.current_thread.text starts with 'FedEx'
  3. sender.email.domain.root_domain not in ('fedex.com', 'fedexfreight.com', 'cj.com', 'sedex.com', 'myworkday.com', 'billtrust.com', 'flying-cargo.rs', 'confirmit.com', 'centercode.com')
  4. all of:
    • not:
      • profile.by_sender().any_messages_benign
    • not:
      • profile.by_sender().solicited
  5. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: file.message_screenshot, ml.logo_detect, ml.nlu_classifier, profile.by_sender, regex.icontains, strings.icontains, strings.ilevenshtein, strings.ilike, strings.istarts_with. Reference lists: $high_trust_sender_root_domains.

Indicators matched (19)

FieldMatchValue
sender.display_namememberfedex
sender.display_namememberfedex shipment
sender.display_namememberfedex tracking updates
strings.ilevenshteinfuzzyfedex
regex.icontainsregex^Fed-?ex
strings.ilikesubstring*fedex*
ml.logo_detect(file.message_screenshot()).brands[].nameequalsFedEx
ml.nlu_classifier(body.current_thread.text).entities[].nameequalsrequest
strings.icontainssubstringsignature
strings.istarts_withprefixFedEx
sender.email.domain.root_domainmemberfedex.com
sender.email.domain.root_domainmemberfedexfreight.com
7 more
sender.email.domain.root_domainmembercj.com
sender.email.domain.root_domainmembersedex.com
sender.email.domain.root_domainmembermyworkday.com
sender.email.domain.root_domainmemberbilltrust.com
sender.email.domain.root_domainmemberflying-cargo.rs
sender.email.domain.root_domainmemberconfirmit.com
sender.email.domain.root_domainmembercentercode.com