Detection rules › Sublime MQL

Brand impersonation: Google using Microsoft Forms

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Abuses Microsoft Forms to impersonate Google.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Lookalike domain, Social engineering

Event coverage

Rule body MQL

type.inbound
and sender.email.domain.domain == 'email.formspro.microsoft.com'
and regex.icontains(sender.display_name, '(google|gmail)')
and regex.icontains(sender.display_name, '(alert|warning|notification)')
// MsgID does not contain Google|Gmail|GoogleMail
and not regex.icontains(headers.message_id,
                        '(mail|mx)?\.?(google(mail)?|gmail.com)'
)
and (
  any(body.links, .href_url.domain.root_domain not in $tranco_1m)
  or strings.ilike(body.html.display_text,
                   "*suspicious activities*",
                   "*failure to secure*",
                   "*loose your*",
                   "*suspended*"
  )
)

Detection logic

Scope: inbound message.

Abuses Microsoft Forms to impersonate Google.

  1. inbound message
  2. sender.email.domain.domain is 'email.formspro.microsoft.com'
  3. sender.display_name matches '(google|gmail)'
  4. sender.display_name matches '(alert|warning|notification)'
  5. not:
    • headers.message_id matches '(mail|mx)?\\.?(google(mail)?|gmail.com)'
  6. any of:
    • any of body.links where:
      • .href_url.domain.root_domain not in $tranco_1m
    • body.html.display_text matches any of 4 patterns
      • *suspicious activities*
      • *failure to secure*
      • *loose your*
      • *suspended*

Inspects: body.html.display_text, body.links, body.links[].href_url.domain.root_domain, headers.message_id, sender.display_name, sender.email.domain.domain, type.inbound. Sensors: regex.icontains, strings.ilike. Reference lists: $tranco_1m.

Indicators matched (8)

FieldMatchValue
sender.email.domain.domainequalsemail.formspro.microsoft.com
regex.icontainsregex(google|gmail)
regex.icontainsregex(alert|warning|notification)
regex.icontainsregex(mail|mx)?\.?(google(mail)?|gmail.com)
strings.ilikesubstring*suspicious activities*
strings.ilikesubstring*failure to secure*
strings.ilikesubstring*loose your*
strings.ilikesubstring*suspended*