Detection rules › Sublime MQL
Brand impersonation: Google using Microsoft Forms
Abuses Microsoft Forms to impersonate Google.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Lookalike domain, Social engineering |
Event coverage
Rule body MQL
type.inbound
and sender.email.domain.domain == 'email.formspro.microsoft.com'
and regex.icontains(sender.display_name, '(google|gmail)')
and regex.icontains(sender.display_name, '(alert|warning|notification)')
// MsgID does not contain Google|Gmail|GoogleMail
and not regex.icontains(headers.message_id,
'(mail|mx)?\.?(google(mail)?|gmail.com)'
)
and (
any(body.links, .href_url.domain.root_domain not in $tranco_1m)
or strings.ilike(body.html.display_text,
"*suspicious activities*",
"*failure to secure*",
"*loose your*",
"*suspended*"
)
)
Detection logic
Scope: inbound message.
Abuses Microsoft Forms to impersonate Google.
- inbound message
- sender.email.domain.domain is 'email.formspro.microsoft.com'
- sender.display_name matches '(google|gmail)'
- sender.display_name matches '(alert|warning|notification)'
not:
- headers.message_id matches '(mail|mx)?\\.?(google(mail)?|gmail.com)'
any of:
any of
body.linkswhere:- .href_url.domain.root_domain not in $tranco_1m
body.html.display_text matches any of 4 patterns
*suspicious activities**failure to secure**loose your**suspended*
Inspects: body.html.display_text, body.links, body.links[].href_url.domain.root_domain, headers.message_id, sender.display_name, sender.email.domain.domain, type.inbound. Sensors: regex.icontains, strings.ilike. Reference lists: $tranco_1m.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
sender.email.domain.domain | equals | email.formspro.microsoft.com |
regex.icontains | regex | (google|gmail) |
regex.icontains | regex | (alert|warning|notification) |
regex.icontains | regex | (mail|mx)?\.?(google(mail)?|gmail.com) |
strings.ilike | substring | *suspicious activities* |
strings.ilike | substring | *failure to secure* |
strings.ilike | substring | *loose your* |
strings.ilike | substring | *suspended* |