detection.wiki

Detection rules › Sublime MQL

Brand impersonation: LinkedIn

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Impersonation of LinkedIn.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Lookalike domain, Social engineering

Event coverage

Message attribute
body.current_thread
headers (collection)
headers.reply_to (collection)
headers.return_path
sender
sender.email
type

Rule body MQL

type.inbound
and (
  sender.display_name =~ 'linkedin'
  or strings.ilevenshtein(sender.display_name, 'linkedin') <= 2
  or strings.ilevenshtein(sender.email.domain.root_domain, 'linkedin.com') <= 2
  or strings.ilike(sender.email.domain.root_domain, "*linkedin.com")
  or (
    strings.ilike(sender.display_name, "*linkedin*")
    and 1 of (
      any(ml.nlu_classifier(body.current_thread.text).intents,
          .name in ("cred_theft", "steal_pii") and .confidence == "high"
      ),
      network.whois(sender.email.domain).days_old <= 30
      and strings.ilike(sender.email.email, "*linkedin*"),
      (
        length(headers.reply_to) > 0
        and all(headers.reply_to,
                .email.domain.root_domain != sender.email.domain.root_domain
        )
        and all(headers.reply_to,
                .email.domain.root_domain != headers.return_path.domain.root_domain
        )
        and sender.email.domain.root_domain != headers.return_path.domain.root_domain
      )
    )
  )
)
and sender.email.domain.root_domain not in (
  'linkedin.com',
  'smartrecruiters.com',
  'teams-events.com',
  'linkeen.com'
)
and sender.email.domain.domain not in ('linkedin.coupahost.com')
and sender.email.email not in $recipient_emails
and not regex.icontains(headers.message_id, '[^-]linkedin.com>$')

// LinkedIn corporate uses DocuSign
and not (
  sender.email.domain.root_domain in~ ('docusign.net', 'docusign.com')
  and all(headers.reply_to, .email.domain.root_domain == 'linkedin.com')
)

Detection logic

Scope: inbound message.

Impersonation of LinkedIn.

  1. inbound message
  2. any of:
    • sender.display_name is 'linkedin'
    • sender.display_name is similar to 'linkedin'
    • sender.email.domain.root_domain is similar to 'linkedin.com'
    • sender.email.domain.root_domain matches '*linkedin.com'
    • all of:
      • sender.display_name matches '*linkedin*'
      • at least 1 of:
        • any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
          • .name in ('cred_theft', 'steal_pii')
          • .confidence is 'high'
        • all of:
          • network.whois(sender.email.domain).days_old ≤ 30
          • sender.email.email matches '*linkedin*'
        • all of:
          • length(headers.reply_to) > 0
          • all of headers.reply_to where:
            • .email.domain.root_domain is not sender.email.domain.root_domain
          • all of headers.reply_to where:
            • .email.domain.root_domain is not headers.return_path.domain.root_domain
          • sender.email.domain.root_domain is not headers.return_path.domain.root_domain
  3. sender.email.domain.root_domain not in ('linkedin.com', 'smartrecruiters.com', 'teams-events.com', 'linkeen.com')
  4. sender.email.domain.domain not in ('linkedin.coupahost.com')
  5. sender.email.email not in $recipient_emails
  6. not:
    • headers.message_id matches '[^-]linkedin.com>$'
  7. not:
    • all of:
      • sender.email.domain.root_domain in ('docusign.net', 'docusign.com')
      • all of headers.reply_to where:
        • .email.domain.root_domain is 'linkedin.com'

Inspects: body.current_thread.text, headers.message_id, headers.reply_to, headers.reply_to[].email.domain.root_domain, headers.return_path.domain.root_domain, sender.display_name, sender.email.domain, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: ml.nlu_classifier, network.whois, regex.icontains, strings.ilevenshtein, strings.ilike. Reference lists: $recipient_emails.

Indicators matched (17)

FieldMatchValue
sender.display_nameequalslinkedin
strings.ilevenshteinfuzzylinkedin
strings.ilevenshteinfuzzylinkedin.com
strings.ilikesubstring*linkedin.com
strings.ilikesubstring*linkedin*
ml.nlu_classifier(body.current_thread.text).intents[].namemembercred_theft
ml.nlu_classifier(body.current_thread.text).intents[].namemembersteal_pii
ml.nlu_classifier(body.current_thread.text).intents[].confidenceequalshigh
sender.email.domain.root_domainmemberlinkedin.com
sender.email.domain.root_domainmembersmartrecruiters.com
sender.email.domain.root_domainmemberteams-events.com
sender.email.domain.root_domainmemberlinkeen.com
5 more
sender.email.domain.domainmemberlinkedin.coupahost.com
regex.icontainsregex[^-]linkedin.com>$
sender.email.domain.root_domainmemberdocusign.net
sender.email.domain.root_domainmemberdocusign.com
headers.reply_to[].email.domain.root_domainequalslinkedin.com