detection.wiki

Detection rules › Sublime MQL

Impersonation: Executive using numbered local part

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages from free email providers where the sender's email address uses a pattern commonly associated with executive impersonation, containing 'chair' or 'ceo' followed by numbers in the local part.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud
Tactics and techniquesFree email provider, Impersonation: VIP, Social engineering

Event coverage

Message attribute
sender.email
type

Rule body MQL

type.inbound
and sender.email.domain.domain in $free_email_providers
and regex.icontains(sender.email.local_part, '^c(?:hair|eo)\d+')

Detection logic

Scope: inbound message.

Detects messages from free email providers where the sender's email address uses a pattern commonly associated with executive impersonation, containing 'chair' or 'ceo' followed by numbers in the local part.

  1. inbound message
  2. sender.email.domain.domain in $free_email_providers
  3. sender.email.local_part matches '^c(?:hair|eo)\\d+'

Inspects: sender.email.domain.domain, sender.email.local_part, type.inbound. Sensors: regex.icontains. Reference lists: $free_email_providers.

Indicators matched (1)

FieldMatchValue
regex.icontainsregex^c(?:hair|eo)\d+