detection.wiki

Detection rules › Sublime MQL

Brand impersonation: Microsoft quarantine release notification in body

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Message containing suspicious quarantine release language in the body, and a Microsoft logo attachment but did not come from Microsoft.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Message attribute
attachments (collection)
body.current_thread
headers.auth_summary
sender.email
type

Rule body MQL

type.inbound
and length(filter(attachments, .file_type not in $file_types_images)) == 0
and any(attachments,
        any(file.explode(.),
            (
              // attachment is most likely only a logo 
              (
                length(.scan.ocr.raw) < 15 or .scan.ocr.raw is null
              )
              and any(ml.logo_detect(..).brands,
                      strings.starts_with(.name, "Microsoft")
              )
            )
        )
        and (
          3 of (
            strings.ilike(body.current_thread.text, "*review*"),
            strings.ilike(body.current_thread.text, "*release*"),
            strings.ilike(body.current_thread.text, "*quarantine*"),
            strings.ilike(body.current_thread.text, "*messages*"),
            strings.ilike(body.current_thread.text, "*blocked*"),
            strings.ilike(body.current_thread.text, "*notification*"),
            strings.ilike(body.current_thread.text, "*kindly*")
          )
        )
)
and sender.email.domain.root_domain not in (
  "bing.com",
  "microsoft.com",
  "microsoftonline.com",
  "microsoftsupport.com",
  "microsoft365.com",
  "office.com",
  "office365.com",
  "onedrive.com",
  "sharepointonline.com",
  "yammer.com",
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender().solicited
and not profile.by_sender().any_messages_benign

Detection logic

Scope: inbound message.

Message containing suspicious quarantine release language in the body, and a Microsoft logo attachment but did not come from Microsoft.

  1. inbound message
  2. length(filter(attachments, .file_type not in $file_types_images)) is 0
  3. any of attachments where all hold:
    • any of file.explode(.) where all hold:
      • any of:
        • length(.scan.ocr.raw) < 15
        • .scan.ocr.raw is missing
      • any of ml.logo_detect(.).brands where:
        • .name starts with 'Microsoft'
    • at least 3 of 7: body.current_thread.text matches any of 7 patterns
      • *review*
      • *release*
      • *quarantine*
      • *messages*
      • *blocked*
      • *notification*
      • *kindly*
  4. sender.email.domain.root_domain not in ('bing.com', 'microsoft.com', 'microsoftonline.com', 'microsoftsupport.com', 'microsoft365.com', 'office.com', 'office365.com', 'onedrive.com', 'sharepointonline.com', 'yammer.com')
  5. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains
  6. not:
    • profile.by_sender().solicited
  7. not:
    • profile.by_sender().any_messages_benign

Inspects: attachments[].file_type, body.current_thread.text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, ml.logo_detect, profile.by_sender, strings.ilike, strings.starts_with. Reference lists: $file_types_images, $high_trust_sender_root_domains.

Indicators matched (18)

FieldMatchValue
strings.starts_withprefixMicrosoft
strings.ilikesubstring*review*
strings.ilikesubstring*release*
strings.ilikesubstring*quarantine*
strings.ilikesubstring*messages*
strings.ilikesubstring*blocked*
strings.ilikesubstring*notification*
strings.ilikesubstring*kindly*
sender.email.domain.root_domainmemberbing.com
sender.email.domain.root_domainmembermicrosoft.com
sender.email.domain.root_domainmembermicrosoftonline.com
sender.email.domain.root_domainmembermicrosoftsupport.com
6 more
sender.email.domain.root_domainmembermicrosoft365.com
sender.email.domain.root_domainmemberoffice.com
sender.email.domain.root_domainmemberoffice365.com
sender.email.domain.root_domainmemberonedrive.com
sender.email.domain.root_domainmembersharepointonline.com
sender.email.domain.root_domainmemberyammer.com