detection.wiki

Detection rules › Sublime MQL

Brand impersonation: UPS

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages impersonating UPS (United Parcel Service) through display name, email address patterns, subject content, or HTML styling that mimics UPS branding, while excluding legitimate UPS domains.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Lookalike domain, Social engineering

Event coverage

Message attribute
body.current_thread
body.html
headers.auth_summary
sender
sender.email
subject
type

Rule body MQL

type.inbound
and sender.email.domain.root_domain not in ("ups.com", "upsemail.com")
and (
  sender.display_name in~ ("UPS My Choice", "UPS Services", "Ups.com")
  or regex.icontains(sender.display_name, 'ups-\w+')
  or strings.ilike(sender.email.local_part, "*united*parcel*service*")
  or strings.ilike(sender.email.domain.domain, '*united*parcel*service*')
  or strings.icontains(subject.subject, 'UPS delivery')
  or sender.email.local_part =~ "ups"
  or regex.icontains(sender.display_name,
                     "U[^a-zA-Z]P[^a-zA-Z]S(?:[^a-zA-Z]|$)"
  )
  or strings.icontains(body.html.raw, 'background-color:#351d20')
  or strings.icontains(body.html.raw, 'background-color: #351d20')
)
and (
  // Observed in the "footer" of impersation messages
  // added this due to the UPS image not loading on some emails
  strings.icontains(body.current_thread.text, "United Parcel Service of")
  or regex.icontains(body.current_thread.text,
                     "(©|®).{0,15}(?:U.?P.?S.?|United Parcel Service)"
  )
  or any(ml.logo_detect(file.message_screenshot()).brands, .name is not null)
)
and sender.email.email not in $recipient_emails

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Detects messages impersonating UPS (United Parcel Service) through display name, email address patterns, subject content, or HTML styling that mimics UPS branding, while excluding legitimate UPS domains.

  1. inbound message
  2. sender.email.domain.root_domain not in ('ups.com', 'upsemail.com')
  3. any of:
    • sender.display_name in ('UPS My Choice', 'UPS Services', 'Ups.com')
    • sender.display_name matches 'ups-\\w+'
    • sender.email.local_part matches '*united*parcel*service*'
    • sender.email.domain.domain matches '*united*parcel*service*'
    • subject.subject contains 'UPS delivery'
    • sender.email.local_part is 'ups'
    • sender.display_name matches 'U[^a-zA-Z]P[^a-zA-Z]S(?:[^a-zA-Z]|$)'
    • body.html.raw contains 'background-color:#351d20'
    • body.html.raw contains 'background-color: #351d20'
  4. any of:
    • body.current_thread.text contains 'United Parcel Service of'
    • body.current_thread.text matches '(©|®).{0,15}(?:U.?P.?S.?|United Parcel Service)'
    • any of ml.logo_detect(file.message_screenshot()).brands where:
      • .name is set
  5. sender.email.email not in $recipient_emails
  6. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.current_thread.text, body.html.raw, headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.email, sender.email.local_part, subject.subject, type.inbound. Sensors: file.message_screenshot, ml.logo_detect, regex.icontains, strings.icontains, strings.ilike. Reference lists: $high_trust_sender_root_domains, $recipient_emails.

Indicators matched (14)

FieldMatchValue
sender.email.domain.root_domainmemberups.com
sender.email.domain.root_domainmemberupsemail.com
sender.display_namememberUPS My Choice
sender.display_namememberUPS Services
sender.display_namememberUps.com
regex.icontainsregexups-\w+
strings.ilikesubstring*united*parcel*service*
strings.icontainssubstringUPS delivery
sender.email.local_partequalsups
regex.icontainsregexU[^a-zA-Z]P[^a-zA-Z]S(?:[^a-zA-Z]|$)
strings.icontainssubstringbackground-color:#351d20
strings.icontainssubstringbackground-color: #351d20
2 more
strings.icontainssubstringUnited Parcel Service of
regex.icontainsregex(©|®).{0,15}(?:U.?P.?S.?|United Parcel Service)