Detection rules › Sublime MQL
Brand impersonation: Microsoft quarantine release notification in image attachment
Message with an image attachment containing credential theft language and references to the Microsoft Exchange quarantine, but did not come from Microsoft.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Free file host, Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and length(filter(attachments, .file_type not in $file_types_images)) == 0
and any(attachments,
any(file.explode(.),
(
any(ml.nlu_classifier(.scan.ocr.raw).intents,
.name == "cred_theft" and .confidence != "low"
)
or (
length(ml.nlu_classifier(.scan.ocr.raw).intents) == 0
and length(ml.nlu_classifier(.scan.ocr.raw).entities) > 2
)
)
and (
(
any(ml.nlu_classifier(.scan.ocr.raw).entities,
.name == "urgency"
)
)
or any(ml.nlu_classifier(.scan.ocr.raw).entities,
.name == "sender" and strings.icontains(.text, "Microsoft")
)
)
)
and any(file.explode(.),
3 of (
strings.icontains(.scan.ocr.raw, "review"),
strings.icontains(.scan.ocr.raw, "release"),
strings.icontains(.scan.ocr.raw, "quarantine"),
strings.icontains(.scan.ocr.raw, "messages"),
strings.icontains(.scan.ocr.raw, "blocked"),
strings.icontains(.scan.ocr.raw, "notification"),
any(ml.logo_detect(..).brands,
strings.starts_with(.name, "Microsoft")
)
)
)
)
and sender.email.domain.root_domain not in (
"bing.com",
"microsoft.com",
"microsoftonline.com",
"microsoftsupport.com",
"microsoft365.com",
"office.com",
"onedrive.com",
"sharepointonline.com",
"yammer.com",
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender().solicited
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
Message with an image attachment containing credential theft language and references to the Microsoft Exchange quarantine, but did not come from Microsoft.
- inbound message
- length(filter(attachments, .file_type not in $file_types_images)) is 0
any of
attachmentswhere all hold:any of
file.explode(.)where all hold:any of:
any of
ml.nlu_classifier(.scan.ocr.raw).intentswhere all hold:- .name is 'cred_theft'
- .confidence is not 'low'
all of:
- length(ml.nlu_classifier(.scan.ocr.raw).intents) is 0
- length(ml.nlu_classifier(.scan.ocr.raw).entities) > 2
any of:
any of
ml.nlu_classifier(.scan.ocr.raw).entitieswhere:- .name is 'urgency'
any of
ml.nlu_classifier(.scan.ocr.raw).entitieswhere all hold:- .name is 'sender'
- .text contains 'Microsoft'
any of
file.explode(.)where:at least 3 of:
- .scan.ocr.raw contains 'review'
- .scan.ocr.raw contains 'release'
- .scan.ocr.raw contains 'quarantine'
- .scan.ocr.raw contains 'messages'
- .scan.ocr.raw contains 'blocked'
- .scan.ocr.raw contains 'notification'
any of
ml.logo_detect(.).brandswhere:- .name starts with 'Microsoft'
- sender.email.domain.root_domain not in ('bing.com', 'microsoft.com', 'microsoftonline.com', 'microsoftsupport.com', 'microsoft365.com', 'office.com', 'onedrive.com', 'sharepointonline.com', 'yammer.com')
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
not:
- profile.by_sender().solicited
not:
- profile.by_sender().any_messages_benign
Inspects: attachments[].file_type, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, ml.logo_detect, ml.nlu_classifier, profile.by_sender, strings.icontains, strings.starts_with. Reference lists: $file_types_images, $high_trust_sender_root_domains.
Indicators matched (20)
| Field | Match | Value |
|---|---|---|
ml.nlu_classifier(file.explode(attachments[])[].scan.ocr.raw).intents[].name | equals | cred_theft |
ml.nlu_classifier(file.explode(attachments[])[].scan.ocr.raw).entities[].name | equals | urgency |
ml.nlu_classifier(file.explode(attachments[])[].scan.ocr.raw).entities[].name | equals | sender |
strings.icontains | substring | Microsoft |
strings.icontains | substring | review |
strings.icontains | substring | release |
strings.icontains | substring | quarantine |
strings.icontains | substring | messages |
strings.icontains | substring | blocked |
strings.icontains | substring | notification |
strings.starts_with | prefix | Microsoft |
sender.email.domain.root_domain | member | bing.com |
8 more
sender.email.domain.root_domain | member | microsoft.com |
sender.email.domain.root_domain | member | microsoftonline.com |
sender.email.domain.root_domain | member | microsoftsupport.com |
sender.email.domain.root_domain | member | microsoft365.com |
sender.email.domain.root_domain | member | office.com |
sender.email.domain.root_domain | member | onedrive.com |
sender.email.domain.root_domain | member | sharepointonline.com |
sender.email.domain.root_domain | member | yammer.com |