detection.wiki

Detection rules › Sublime MQL

Brand impersonation: Ripple

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Attack impersonating Ripple cryptocurrency, potentially in the form of a giveaway scam.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Message attribute
sender
sender.email
type

Rule body MQL

type.inbound
and regex.imatch(sender.display_name, '\bripple\b')
and sender.email.domain.root_domain not in ("ripple.com", "ripplejobs.co.uk")

Detection logic

Scope: inbound message.

Attack impersonating Ripple cryptocurrency, potentially in the form of a giveaway scam.

  1. inbound message
  2. sender.display_name matches '\\bripple\\b'
  3. sender.email.domain.root_domain not in ('ripple.com', 'ripplejobs.co.uk')

Inspects: sender.display_name, sender.email.domain.root_domain, type.inbound. Sensors: regex.imatch.

Indicators matched (3)

FieldMatchValue
regex.imatchregex\bripple\b
sender.email.domain.root_domainmemberripple.com
sender.email.domain.root_domainmemberripplejobs.co.uk