Detection rules › Sublime MQL
VIP impersonation with urgent request (strict match, untrusted sender)
Sender is using a display name that matches the display name of someone in your $org_vips list. Detects potential Business Email Compromise (BEC) attacks by analyzing text within email body from untrusted senders.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Impersonation: VIP, Social engineering |
Event coverage
Rule body MQL
type.inbound
and any($org_vips, .display_name =~ sender.display_name)
and (
any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "bec" and .confidence in ("medium", "high")
)
or (
any(ml.nlu_classifier(body.current_thread.text).entities,
.name == "urgency"
)
and any(ml.nlu_classifier(body.current_thread.text).entities,
.name == "request"
)
)
)
and (
(
profile.by_sender().prevalence != "common"
and not profile.by_sender().solicited
)
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
or profile.by_sender().days_since.last_outbound > 365
)
// negate sharepoint notifications originating from within the org
and not (
sender.email.email in ('no-reply@sharepointonline.com')
and length(headers.reply_to) > 0
and all(headers.reply_to, .email.domain.root_domain in $org_domains)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
Sender is using a display name that matches the display name of someone in your $org_vips list. Detects potential Business Email Compromise (BEC) attacks by analyzing text within email body from untrusted senders.
- inbound message
any of
$org_vipswhere:- .display_name is sender.display_name
any of:
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'bec'
- .confidence in ('medium', 'high')
all of:
any of
ml.nlu_classifier(body.current_thread.text).entitieswhere:- .name is 'urgency'
any of
ml.nlu_classifier(body.current_thread.text).entitieswhere:- .name is 'request'
any of:
all of:
- profile.by_sender().prevalence is not 'common'
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
- profile.by_sender().days_since.last_outbound > 365
not:
all of:
- sender.email.email in ('no-reply@sharepointonline.com')
- length(headers.reply_to) > 0
all of
headers.reply_towhere:- .email.domain.root_domain in $org_domains
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
not:
- profile.by_sender().any_messages_benign
Inspects: body.current_thread.text, headers.auth_summary.dmarc.pass, headers.reply_to, headers.reply_to[].email.domain.root_domain, sender.display_name, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender. Reference lists: $high_trust_sender_root_domains, $org_domains, $org_vips.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | bec |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | member | medium |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | member | high |
ml.nlu_classifier(body.current_thread.text).entities[].name | equals | urgency |
ml.nlu_classifier(body.current_thread.text).entities[].name | equals | request |
sender.email.email | member | no-reply@sharepointonline.com |