Detection rules › Sublime MQL
Brand impersonation: Norton
Scans files to detect Norton (Lifelock|360|Security) impersonation.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Free email provider, Impersonation: Brand, Social engineering |
Event coverage
Rule body MQL
type.inbound
and sender.email.domain.domain != "norton.com"
and any(attachments,
(.file_type in $file_types_images or .file_type == "pdf")
and (
(
strings.ilike(.file_name, "*norton*")
and not (
any(recipients.to, strings.iends_with(.display_name, "Norton"))
)
)
or any(file.explode(.),
regex.icontains(.scan.ocr.raw,
".*norton.?60.*",
".*lifelock.*",
".*norton.?security.*",
".*norton.?anti.?virus.*",
".*Norton.{2,3}subscription.*"
)
)
)
)
and (
(
// if freemail, flag if it's a first-time sender
sender.email.domain.root_domain in $free_email_providers
and sender.email.email not in $sender_emails
)
or (
// if custom domain, we want to avoid flagging
// on the real Norton invoices
// so we flag if it's not a first-time sender
// and if it's not in the tranco 1M w/ a reply-to mismatch
// for example we've observed:
// Sender: Norton <quickbooks@notification.intuit.com>
// Reply-to: foo@outlook.com
sender.email.domain.root_domain not in $free_email_providers
and sender.email.domain.domain not in $sender_domains
and (
sender.email.domain.root_domain not in $tranco_1m
or any(headers.reply_to,
.email.domain.domain != sender.email.domain.domain
)
)
)
or (
(
length(recipients.to) == 0
or all(recipients.to, .display_name == "Undisclosed recipients")
)
and length(recipients.cc) == 0
and length(recipients.bcc) == 0
)
)
Detection logic
Scope: inbound message.
Scans files to detect Norton (Lifelock|360|Security) impersonation.
- inbound message
- sender.email.domain.domain is not 'norton.com'
any of
attachmentswhere all hold:any of:
- .file_type in $file_types_images
- .file_type is 'pdf'
any of:
all of:
- .file_name matches '*norton*'
not:
any of
recipients.towhere:- .display_name ends with 'Norton'
any of
file.explode(.)where:.scan.ocr.raw matches any of 5 patterns
.*norton.?60.*.*lifelock.*.*norton.?security.*.*norton.?anti.?virus.*.*Norton.{2,3}subscription.*
any of:
all of:
- sender.email.domain.root_domain in $free_email_providers
- sender.email.email not in $sender_emails
all of:
- sender.email.domain.root_domain not in $free_email_providers
- sender.email.domain.domain not in $sender_domains
any of:
- sender.email.domain.root_domain not in $tranco_1m
any of
headers.reply_towhere:- .email.domain.domain is not sender.email.domain.domain
all of:
any of:
- length(recipients.to) is 0
all of
recipients.towhere:- .display_name is 'Undisclosed recipients'
- length(recipients.cc) is 0
- length(recipients.bcc) is 0
Inspects: attachments[].file_name, attachments[].file_type, headers.reply_to, headers.reply_to[].email.domain.domain, recipients.bcc, recipients.cc, recipients.to, recipients.to[].display_name, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: file.explode, regex.icontains, strings.iends_with, strings.ilike. Reference lists: $file_types_images, $free_email_providers, $sender_domains, $sender_emails, $tranco_1m.
Indicators matched (9)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
strings.ilike | substring | *norton* |
strings.iends_with | suffix | Norton |
regex.icontains | regex | .*norton.?60.* |
regex.icontains | regex | .*lifelock.* |
regex.icontains | regex | .*norton.?security.* |
regex.icontains | regex | .*norton.?anti.?virus.* |
regex.icontains | regex | .*Norton.{2,3}subscription.* |
recipients.to[].display_name | equals | Undisclosed recipients |