Detection rules › Sublime MQL
Brand impersonation: Sublime Security
Possible attempt to impersonate Sublime Security executives.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Lookalike domain, Social engineering |
Event coverage
| Message attribute |
|---|
| headers.auth_summary |
| sender |
| sender.email |
| type |
Rule body MQL
type.inbound
and (
sender.display_name in~ (
'Sublime Security',
'Josh Kamdjou',
'Joshua Kamdjou',
'Ian Thiel'
)
or strings.ilevenshtein(sender.email.domain.domain, 'sublimesecurity.com') <= 2
)
and sender.email.domain.root_domain not in (
'sublimesecurity.com',
'luma-mail.com',
'modernloop.io',
'tabsplatform.com'
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Possible attempt to impersonate Sublime Security executives.
- inbound message
any of:
- sender.display_name in ('Sublime Security', 'Josh Kamdjou', 'Joshua Kamdjou', 'Ian Thiel')
- sender.email.domain.domain is similar to 'sublimesecurity.com'
- sender.email.domain.root_domain not in ('sublimesecurity.com', 'luma-mail.com', 'modernloop.io', 'tabsplatform.com')
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: strings.ilevenshtein. Reference lists: $high_trust_sender_root_domains.
Indicators matched (9)
| Field | Match | Value |
|---|---|---|
sender.display_name | member | Sublime Security |
sender.display_name | member | Josh Kamdjou |
sender.display_name | member | Joshua Kamdjou |
sender.display_name | member | Ian Thiel |
strings.ilevenshtein | fuzzy | sublimesecurity.com |
sender.email.domain.root_domain | member | sublimesecurity.com |
sender.email.domain.root_domain | member | luma-mail.com |
sender.email.domain.root_domain | member | modernloop.io |
sender.email.domain.root_domain | member | tabsplatform.com |