Detection rules › Sublime MQL
Brand impersonation: Microsoft Teams
Impersonation of a Microsoft Teams message.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
and length(filter(attachments,
.file_type in $file_types_images or .file_type == "pdf"
)
) < 10
and any(attachments,
(.file_type in $file_types_images or .file_type == "pdf")
and any(file.explode(.),
regex.icontains(.scan.ocr.raw,
"trying to reach you.*microsoft teams"
)
)
)
and sender.email.domain.root_domain not in (
"microsoft.com",
"microsoftsupport.com",
"office.com"
)
Detection logic
Scope: inbound message.
Impersonation of a Microsoft Teams message.
- inbound message
- length(filter(attachments, .file_type in $file_types_images or .file_type == 'pdf')) < 10
any of
attachmentswhere all hold:any of:
- .file_type in $file_types_images
- .file_type is 'pdf'
any of
file.explode(.)where:- .scan.ocr.raw matches 'trying to reach you.*microsoft teams'
- sender.email.domain.root_domain not in ('microsoft.com', 'microsoftsupport.com', 'office.com')
Inspects: attachments[].file_type, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, regex.icontains. Reference lists: $file_types_images.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
regex.icontains | regex | trying to reach you.*microsoft teams |
sender.email.domain.root_domain | member | microsoft.com |
sender.email.domain.root_domain | member | microsoftsupport.com |
sender.email.domain.root_domain | member | office.com |