Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Lookalike domain, Social engineering |
Event coverage
| Message attribute |
|---|
| headers.auth_summary |
| sender |
| sender.email |
| type |
Rule body MQL
type.inbound
and (
regex.imatch(sender.display_name, '\bvanta\b')
or regex.imatch(sender.email.local_part, '(\b)vanta|vanta(\b)')
or strings.ilevenshtein(sender.email.domain.sld, 'vanta') <= 1
)
and not (
strings.ilike(sender.display_name, '*advantage*')
or strings.ilike(sender.email.email, '*advantage*')
or strings.ilevenshtein(sender.email.domain.sld, 'advantage') <= 1
)
and sender.email.domain.root_domain in $free_email_providers
and sender.email.email not in $sender_emails
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Impersonation of Vanta.
- inbound message
any of:
- sender.display_name matches '\\bvanta\\b'
- sender.email.local_part matches '(\\b)vanta|vanta(\\b)'
- sender.email.domain.sld is similar to 'vanta'
none of:
- sender.display_name matches '*advantage*'
- sender.email.email matches '*advantage*'
- sender.email.domain.sld is similar to 'advantage'
- sender.email.domain.root_domain in $free_email_providers
- sender.email.email not in $sender_emails
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.root_domain, sender.email.domain.sld, sender.email.email, sender.email.local_part, type.inbound. Sensors: regex.imatch, strings.ilevenshtein, strings.ilike. Reference lists: $free_email_providers, $high_trust_sender_root_domains, $sender_emails.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
regex.imatch | regex | \bvanta\b |
regex.imatch | regex | (\b)vanta|vanta(\b) |
strings.ilevenshtein | fuzzy | vanta |
strings.ilike | substring | *advantage* |
strings.ilevenshtein | fuzzy | advantage |