Detection rules › Sublime MQL
Brand impersonation: Purdue ePlanroom with suspicious links
Detects messages impersonating Purdue ePlanroom with links that either not from the legitimate reprographix.com domain or contain suspicious credential theft indicators.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, BEC/Fraud |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
Rule body MQL
type.inbound
and strings.icontains(body.current_thread.text, "Purdue ePlanroom")
and (
any(filter(body.links, strings.contains(.display_text, "Review This Project")),
.href_url.domain.root_domain != "reprographix.com"
)
or any(body.links, ml.link_analysis(.).credphish.disposition == "phishing")
)
and not (
sender.email.domain.root_domain == "reprographix.com"
and headers.auth_summary.dmarc.pass
)
Detection logic
Scope: inbound message.
Detects messages impersonating Purdue ePlanroom with links that either not from the legitimate reprographix.com domain or contain suspicious credential theft indicators.
- inbound message
- body.current_thread.text contains 'Purdue ePlanroom'
any of:
any of
filter(body.links)where:- .href_url.domain.root_domain is not 'reprographix.com'
any of
body.linkswhere:- ml.link_analysis(.).credphish.disposition is 'phishing'
not:
all of:
- sender.email.domain.root_domain is 'reprographix.com'
- headers.auth_summary.dmarc.pass
Inspects: body.current_thread.text, body.links, body.links[].display_text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: ml.link_analysis, strings.contains, strings.icontains.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | Purdue ePlanroom |
strings.contains | substring | Review This Project |
sender.email.domain.root_domain | equals | reprographix.com |