detection.wiki

Detection rules › Sublime MQL

Brand impersonation: Wise

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Impersonating Wise Financial, an online banking platform.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Message attribute
attachments (collection)
body
body.current_thread
body.links (collection)
headers.auth_summary
sender
sender.email
type

Rule body MQL

type.inbound
and (
  regex.icontains(sender.display_name, '\bwise\b')
  or strings.ilike(sender.email.domain.domain, '*wise*')
)
and (
  any(ml.nlu_classifier(body.current_thread.text).tags,
      .name in ("payment", "invoice")
  )
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name in ("cred_theft", "steal_pii") and .confidence == "high"
  )
)
and (
  any(attachments,
      .file_type in $file_extensions_common_archives
      or .file_type in $file_extensions_executables
      or .file_type in $file_extensions_macros
      or .file_type in ("lz")
      or (
        .file_extension is null
        and .file_type == "unknown"
        and .content_type == "application/octet-stream"
        and .size < 100000000
      )
  )
  or any(body.links,
         regex.icontains(.display_text,
                         // https://github.com/sublime-security/static-files/blob/main/suspicious_subjects_regex.txt
                         "termination.*notice",
                         "38417",
                         ":completed",
                         "[il1]{2}mit.*ma[il1]{2} ?bo?x",
                         "[il][il][il]egai[ -]",
                         "[li][li][li]ega[li] attempt",
                         "[ng]-?[io]n .*block",
                         "[ng]-?[io]n .*cancel",
                         "[ng]-?[io]n .*deactiv",
                         "[ng]-?[io]n .*disabl",
                         "action.*required",
                         "abandon.*package",
                         "about.your.account",
                         "acc(ou)?n?t (is )?on ho[li]d",
                         "acc(ou)?n?t.*terminat",
                         "acc(oun)?t.*[il1]{2}mitation",
                         "access.*limitation",
                         "account (will be )?block",
                         "account.*de-?activat",
                         "account.*locked",
                         "account.*re-verification",
                         "account.*security",
                         "account.*suspension",
                         "account.has.been",
                         "account.has.expired",
                         "account.will.be.blocked",
                         "account v[il]o[li]at",
                         "activity.*acc(oun)?t",
                         "almost.full",
                         "app[li]e.[il]d",
                         "authenticate.*account",
                         "been.*suspend",
                         "clos.*of.*account.*processed",
                         "confirm.your.account",
                         "courier.*able",
                         "crediential.*notif",
                         "deactivation.*in.*progress",
                         "delivery.*attempt.*failed",
                         "document.received",
                         "documented.*shared.*with.*you",
                         "dropbox.*document",
                         "e-?ma[il1]+ .{010}suspen",
                         "e-?ma[il1]{1} user",
                         "e-?ma[il1]{2} acc",
                         "e-?ma[il1]{2}.*up.?grade",
                         "e.?ma[il1]{2}.*server",
                         "e.?ma[il1]{2}.*suspend",
                         "email.update",
                         "faxed you",
                         "fraud(ulent)?.*charge",
                         "from.helpdesk",
                         "fu[il1]{2}.*ma[il1]+[ -]?box",
                         "has.been.*suspended",
                         "has.been.limited",
                         "have.locked",
                         "he[li]p ?desk upgrade",
                         "heipdesk",
                         "i[il]iega[il]",
                         "ii[il]ega[il]",
                         "incoming e?mail",
                         "incoming.*fax",
                         "lock.*security",
                         "ma[il1]{1}[ -]?box.*quo",
                         "ma[il1]{2}[ -]?box.*fu[il1]",
                         "ma[il1]{2}box.*[il1]{2}mit",
                         "ma[il1]{2}box stor",
                         "mail on.?hold",
                         "mail.*box.*migration",
                         "mail.*de-?activat",
                         "mail.update.required",
                         "mails.*pending",
                         "messages.*pending",
                         "missed.*shipping.*notification",
                         "missed.shipment.notification",
                         "must.update.your.account",
                         "new [sl][io]g?[nig][ -]?in from",
                         "new voice ?-?mail",
                         "notifications.*pending",
                         "office.*3.*6.*5.*suspend",
                         "office365",
                         "on google docs with you",
                         "online doc",
                         "password.*compromised",
                         "periodic maintenance",
                         "potential(ly)? unauthorized",
                         "refund not approved",
                         "revised.*policy",
                         "scam",
                         "scanned.?invoice",
                         "secured?.update",
                         "security breach",
                         "securlty",
                         "signed.*delivery",
                         "status of your .{314}? ?delivery",
                         "susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty",
                         "suspicious.*sign.*[io]n",
                         "suspicious.activit",
                         "temporar(il)?y deactivate",
                         "temporar[il1]{2}y disab[li]ed",
                         "temporarily.*lock",
                         "un-?usua[li].activity",
                         "unable.*deliver",
                         "unauthorized.*activit",
                         "unauthorized.device",
                         "undelivered message",
                         "unread.*doc",
                         "unusual.activity",
                         "upgrade.*account",
                         "upgrade.notice",
                         "urgent message",
                         "urgent.verification",
                         "v[il1]o[li1]at[il1]on security",
                         "va[il1]{1}date.*ma[il1]{2}[ -]?box",
                         "verification ?-?require",
                         "verification( )?-?need",
                         "verify.your?.account",
                         "web ?-?ma[il1]{2}",
                         "web[ -]?ma[il1]{2}",
                         "will.be.suspended",
                         "your (customer )?account .as",
                         "your.office.365",
                         "your.online.access",

                         // https://github.com/sublime-security/static-files/blob/main/suspicious_subjects.txt
                         "account has been limited",
                         "action required",
                         "almost full",
                         "apd notifi cation",
                         "are you at your desk",
                         "are you available",
                         "attached file to docusign",
                         "banking is temporarily unavailable",
                         "bankofamerica",
                         "closing statement invoice",
                         "completed: docusign",
                         "de-activation of",
                         "delivery attempt",
                         "delivery stopped for shipment",
                         "detected suspicious",
                         "detected suspicious actvity",
                         "docu sign",
                         "document for you",
                         "document has been sent to you via docusign",
                         "document is ready for signature",
                         "docusign",
                         "encrypted message",
                         "failed delivery",
                         "fedex tracking",
                         "file was shared",
                         "freefax",
                         "fwd: due invoice paid",
                         "has shared",
                         "inbox is full",
                         "invitation to comment",
                         "invitation to edit",
                         "invoice due",
                         "left you a message",
                         "message from",
                         "new message",
                         "new voicemail",
                         "on desk",
                         "out of space",
                         "password reset",
                         "payment status",
                         "quick reply",
                         "re: w-2",
                         "required",
                         "required: completed docusign",
                         "ringcentral",
                         "scanned image",
                         "secured files",
                         "secured pdf",
                         "security alert",
                         "new sign-in",
                         "new sign in",
                         "sign-in attempt",
                         "sign in attempt",
                         "staff review",
                         "suspicious activity",
                         "unrecognized login attempt",
                         "upgrade immediately",
                         "urgent",
                         "wants to share",
                         "w2",
                         "you have notifications pending",
                         "your account",
                         "your amazon order",
                         "your document settlement",
                         "your order with amazon",
                         "your password has been compromised",
         )
  )
)
and sender.email.domain.root_domain not in~ (
  'wise.com',
  'wise.jobs',
  'splitwise.com',
  'connectwise.com'
)
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Impersonating Wise Financial, an online banking platform.

  1. inbound message
  2. any of:
    • sender.display_name matches '\\bwise\\b'
    • sender.email.domain.domain matches '*wise*'
  3. any of:
    • any of ml.nlu_classifier(body.current_thread.text).tags where:
      • .name in ('payment', 'invoice')
    • any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
      • .name in ('cred_theft', 'steal_pii')
      • .confidence is 'high'
  4. any of:
    • any of attachments where any holds:
      • .file_type in $file_extensions_common_archives
      • .file_type in $file_extensions_executables
      • .file_type in $file_extensions_macros
      • .file_type in ('lz')
      • all of:
        • .file_extension is missing
        • .file_type is 'unknown'
        • .content_type is 'application/octet-stream'
        • .size < 100000000
    • any of body.links where:
      • .display_text matches any of 188 patterns
        • termination.*notice
        • 38417
        • :completed
        • [il1]{2}mit.*ma[il1]{2} ?bo?x
        • [il][il][il]egai[ -]
        • [li][li][li]ega[li] attempt
        • [ng]-?[io]n .*block
        • [ng]-?[io]n .*cancel
        • [ng]-?[io]n .*deactiv
        • [ng]-?[io]n .*disabl
        • action.*required
        • abandon.*package
        • about.your.account
        • acc(ou)?n?t (is )?on ho[li]d
        • acc(ou)?n?t.*terminat
        • acc(oun)?t.*[il1]{2}mitation
        • access.*limitation
        • account (will be )?block
        • account.*de-?activat
        • account.*locked
        • account.*re-verification
        • account.*security
        • account.*suspension
        • account.has.been
        • account.has.expired
        • account.will.be.blocked
        • account v[il]o[li]at
        • activity.*acc(oun)?t
        • almost.full
        • app[li]e.[il]d
        • authenticate.*account
        • been.*suspend
        • clos.*of.*account.*processed
        • confirm.your.account
        • courier.*able
        • crediential.*notif
        • deactivation.*in.*progress
        • delivery.*attempt.*failed
        • document.received
        • documented.*shared.*with.*you
        • dropbox.*document
        • e-?ma[il1]+ .{010}suspen
        • e-?ma[il1]{1} user
        • e-?ma[il1]{2} acc
        • e-?ma[il1]{2}.*up.?grade
        • e.?ma[il1]{2}.*server
        • e.?ma[il1]{2}.*suspend
        • email.update
        • faxed you
        • fraud(ulent)?.*charge
        • from.helpdesk
        • fu[il1]{2}.*ma[il1]+[ -]?box
        • has.been.*suspended
        • has.been.limited
        • have.locked
        • he[li]p ?desk upgrade
        • heipdesk
        • i[il]iega[il]
        • ii[il]ega[il]
        • incoming e?mail
        • incoming.*fax
        • lock.*security
        • ma[il1]{1}[ -]?box.*quo
        • ma[il1]{2}[ -]?box.*fu[il1]
        • ma[il1]{2}box.*[il1]{2}mit
        • ma[il1]{2}box stor
        • mail on.?hold
        • mail.*box.*migration
        • mail.*de-?activat
        • mail.update.required
        • mails.*pending
        • messages.*pending
        • missed.*shipping.*notification
        • missed.shipment.notification
        • must.update.your.account
        • new [sl][io]g?[nig][ -]?in from
        • new voice ?-?mail
        • notifications.*pending
        • office.*3.*6.*5.*suspend
        • office365
        • on google docs with you
        • online doc
        • password.*compromised
        • periodic maintenance
        • potential(ly)? unauthorized
        • refund not approved
        • revised.*policy
        • scam
        • scanned.?invoice
        • secured?.update
        • security breach
        • securlty
        • signed.*delivery
        • status of your .{314}? ?delivery
        • susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty
        • suspicious.*sign.*[io]n
        • suspicious.activit
        • temporar(il)?y deactivate
        • temporar[il1]{2}y disab[li]ed
        • temporarily.*lock
        • un-?usua[li].activity
        • unable.*deliver
        • unauthorized.*activit
        • unauthorized.device
        • undelivered message
        • unread.*doc
        • unusual.activity
        • upgrade.*account
        • upgrade.notice
        • urgent message
        • urgent.verification
        • v[il1]o[li1]at[il1]on security
        • va[il1]{1}date.*ma[il1]{2}[ -]?box
        • verification ?-?require
        • verification( )?-?need
        • verify.your?.account
        • web ?-?ma[il1]{2}
        • web[ -]?ma[il1]{2}
        • will.be.suspended
        • your (customer )?account .as
        • your.office.365
        • your.online.access
        • account has been limited
        • action required
        • almost full
        • apd notifi cation
        • are you at your desk
        • are you available
        • attached file to docusign
        • banking is temporarily unavailable
        • bankofamerica
        • closing statement invoice
        • completed: docusign
        • de-activation of
        • delivery attempt
        • delivery stopped for shipment
        • detected suspicious
        • detected suspicious actvity
        • docu sign
        • document for you
        • document has been sent to you via docusign
        • document is ready for signature
        • docusign
        • encrypted message
        • failed delivery
        • fedex tracking
        • file was shared
        • freefax
        • fwd: due invoice paid
        • has shared
        • inbox is full
        • invitation to comment
        • invitation to edit
        • invoice due
        • left you a message
        • message from
        • new message
        • new voicemail
        • on desk
        • out of space
        • password reset
        • payment status
        • quick reply
        • re: w-2
        • required
        • required: completed docusign
        • ringcentral
        • scanned image
        • secured files
        • secured pdf
        • security alert
        • new sign-in
        • new sign in
        • sign-in attempt
        • sign in attempt
        • staff review
        • suspicious activity
        • unrecognized login attempt
        • upgrade immediately
        • urgent
        • wants to share
        • w2
        • you have notifications pending
        • your account
        • your amazon order
        • your document settlement
        • your order with amazon
        • your password has been compromised
  5. sender.email.domain.root_domain not in ('wise.com', 'wise.jobs', 'splitwise.com', 'connectwise.com')
  6. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, attachments[].size, body.current_thread.text, body.links, body.links[].display_text, headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.ilike. Reference lists: $file_extensions_common_archives, $file_extensions_executables, $file_extensions_macros, $high_trust_sender_root_domains.

Indicators matched (202)

FieldMatchValue
regex.icontainsregex\bwise\b
strings.ilikesubstring*wise*
ml.nlu_classifier(body.current_thread.text).tags[].namememberpayment
ml.nlu_classifier(body.current_thread.text).tags[].namememberinvoice
ml.nlu_classifier(body.current_thread.text).intents[].namemembercred_theft
ml.nlu_classifier(body.current_thread.text).intents[].namemembersteal_pii
ml.nlu_classifier(body.current_thread.text).intents[].confidenceequalshigh
attachments[].file_typememberlz
attachments[].file_typeequalsunknown
attachments[].content_typeequalsapplication/octet-stream
regex.icontainsregextermination.*notice
regex.icontainsregex38417
190 more
regex.icontainsregex:completed
regex.icontainsregex[il1]{2}mit.*ma[il1]{2} ?bo?x
regex.icontainsregex[il][il][il]egai[ -]
regex.icontainsregex[li][li][li]ega[li] attempt
regex.icontainsregex[ng]-?[io]n .*block
regex.icontainsregex[ng]-?[io]n .*cancel
regex.icontainsregex[ng]-?[io]n .*deactiv
regex.icontainsregex[ng]-?[io]n .*disabl
regex.icontainsregexaction.*required
regex.icontainsregexabandon.*package
regex.icontainsregexabout.your.account
regex.icontainsregexacc(ou)?n?t (is )?on ho[li]d
regex.icontainsregexacc(ou)?n?t.*terminat
regex.icontainsregexacc(oun)?t.*[il1]{2}mitation
regex.icontainsregexaccess.*limitation
regex.icontainsregexaccount (will be )?block
regex.icontainsregexaccount.*de-?activat
regex.icontainsregexaccount.*locked
regex.icontainsregexaccount.*re-verification
regex.icontainsregexaccount.*security
regex.icontainsregexaccount.*suspension
regex.icontainsregexaccount.has.been
regex.icontainsregexaccount.has.expired
regex.icontainsregexaccount.will.be.blocked
regex.icontainsregexaccount v[il]o[li]at
regex.icontainsregexactivity.*acc(oun)?t
regex.icontainsregexalmost.full
regex.icontainsregexapp[li]e.[il]d
regex.icontainsregexauthenticate.*account
regex.icontainsregexbeen.*suspend
regex.icontainsregexclos.*of.*account.*processed
regex.icontainsregexconfirm.your.account
regex.icontainsregexcourier.*able
regex.icontainsregexcrediential.*notif
regex.icontainsregexdeactivation.*in.*progress
regex.icontainsregexdelivery.*attempt.*failed
regex.icontainsregexdocument.received
regex.icontainsregexdocumented.*shared.*with.*you
regex.icontainsregexdropbox.*document
regex.icontainsregexe-?ma[il1]+ .{010}suspen
regex.icontainsregexe-?ma[il1]{1} user
regex.icontainsregexe-?ma[il1]{2} acc
regex.icontainsregexe-?ma[il1]{2}.*up.?grade
regex.icontainsregexe.?ma[il1]{2}.*server
regex.icontainsregexe.?ma[il1]{2}.*suspend
regex.icontainsregexemail.update
regex.icontainsregexfaxed you
regex.icontainsregexfraud(ulent)?.*charge
regex.icontainsregexfrom.helpdesk
regex.icontainsregexfu[il1]{2}.*ma[il1]+[ -]?box
regex.icontainsregexhas.been.*suspended
regex.icontainsregexhas.been.limited
regex.icontainsregexhave.locked
regex.icontainsregexhe[li]p ?desk upgrade
regex.icontainsregexheipdesk
regex.icontainsregexi[il]iega[il]
regex.icontainsregexii[il]ega[il]
regex.icontainsregexincoming e?mail
regex.icontainsregexincoming.*fax
regex.icontainsregexlock.*security
regex.icontainsregexma[il1]{1}[ -]?box.*quo
regex.icontainsregexma[il1]{2}[ -]?box.*fu[il1]
regex.icontainsregexma[il1]{2}box.*[il1]{2}mit
regex.icontainsregexma[il1]{2}box stor
regex.icontainsregexmail on.?hold
regex.icontainsregexmail.*box.*migration
regex.icontainsregexmail.*de-?activat
regex.icontainsregexmail.update.required
regex.icontainsregexmails.*pending
regex.icontainsregexmessages.*pending
regex.icontainsregexmissed.*shipping.*notification
regex.icontainsregexmissed.shipment.notification
regex.icontainsregexmust.update.your.account
regex.icontainsregexnew [sl][io]g?[nig][ -]?in from
regex.icontainsregexnew voice ?-?mail
regex.icontainsregexnotifications.*pending
regex.icontainsregexoffice.*3.*6.*5.*suspend
regex.icontainsregexoffice365
regex.icontainsregexon google docs with you
regex.icontainsregexonline doc
regex.icontainsregexpassword.*compromised
regex.icontainsregexperiodic maintenance
regex.icontainsregexpotential(ly)? unauthorized
regex.icontainsregexrefund not approved
regex.icontainsregexrevised.*policy
regex.icontainsregexscam
regex.icontainsregexscanned.?invoice
regex.icontainsregexsecured?.update
regex.icontainsregexsecurity breach
regex.icontainsregexsecurlty
regex.icontainsregexsigned.*delivery
regex.icontainsregexstatus of your .{314}? ?delivery
regex.icontainsregexsusp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty
regex.icontainsregexsuspicious.*sign.*[io]n
regex.icontainsregexsuspicious.activit
regex.icontainsregextemporar(il)?y deactivate
regex.icontainsregextemporar[il1]{2}y disab[li]ed
regex.icontainsregextemporarily.*lock
regex.icontainsregexun-?usua[li].activity
regex.icontainsregexunable.*deliver
regex.icontainsregexunauthorized.*activit
regex.icontainsregexunauthorized.device
regex.icontainsregexundelivered message
regex.icontainsregexunread.*doc
regex.icontainsregexunusual.activity
regex.icontainsregexupgrade.*account
regex.icontainsregexupgrade.notice
regex.icontainsregexurgent message
regex.icontainsregexurgent.verification
regex.icontainsregexv[il1]o[li1]at[il1]on security
regex.icontainsregexva[il1]{1}date.*ma[il1]{2}[ -]?box
regex.icontainsregexverification ?-?require
regex.icontainsregexverification( )?-?need
regex.icontainsregexverify.your?.account
regex.icontainsregexweb ?-?ma[il1]{2}
regex.icontainsregexweb[ -]?ma[il1]{2}
regex.icontainsregexwill.be.suspended
regex.icontainsregexyour (customer )?account .as
regex.icontainsregexyour.office.365
regex.icontainsregexyour.online.access
regex.icontainsregexaccount has been limited
regex.icontainsregexaction required
regex.icontainsregexalmost full
regex.icontainsregexapd notifi cation
regex.icontainsregexare you at your desk
regex.icontainsregexare you available
regex.icontainsregexattached file to docusign
regex.icontainsregexbanking is temporarily unavailable
regex.icontainsregexbankofamerica
regex.icontainsregexclosing statement invoice
regex.icontainsregexcompleted: docusign
regex.icontainsregexde-activation of
regex.icontainsregexdelivery attempt
regex.icontainsregexdelivery stopped for shipment
regex.icontainsregexdetected suspicious
regex.icontainsregexdetected suspicious actvity
regex.icontainsregexdocu sign
regex.icontainsregexdocument for you
regex.icontainsregexdocument has been sent to you via docusign
regex.icontainsregexdocument is ready for signature
regex.icontainsregexdocusign
regex.icontainsregexencrypted message
regex.icontainsregexfailed delivery
regex.icontainsregexfedex tracking
regex.icontainsregexfile was shared
regex.icontainsregexfreefax
regex.icontainsregexfwd: due invoice paid
regex.icontainsregexhas shared
regex.icontainsregexinbox is full
regex.icontainsregexinvitation to comment
regex.icontainsregexinvitation to edit
regex.icontainsregexinvoice due
regex.icontainsregexleft you a message
regex.icontainsregexmessage from
regex.icontainsregexnew message
regex.icontainsregexnew voicemail
regex.icontainsregexon desk
regex.icontainsregexout of space
regex.icontainsregexpassword reset
regex.icontainsregexpayment status
regex.icontainsregexquick reply
regex.icontainsregexre: w-2
regex.icontainsregexrequired
regex.icontainsregexrequired: completed docusign
regex.icontainsregexringcentral
regex.icontainsregexscanned image
regex.icontainsregexsecured files
regex.icontainsregexsecured pdf
regex.icontainsregexsecurity alert
regex.icontainsregexnew sign-in
regex.icontainsregexnew sign in
regex.icontainsregexsign-in attempt
regex.icontainsregexsign in attempt
regex.icontainsregexstaff review
regex.icontainsregexsuspicious activity
regex.icontainsregexunrecognized login attempt
regex.icontainsregexupgrade immediately
regex.icontainsregexurgent
regex.icontainsregexwants to share
regex.icontainsregexw2
regex.icontainsregexyou have notifications pending
regex.icontainsregexyour account
regex.icontainsregexyour amazon order
regex.icontainsregexyour document settlement
regex.icontainsregexyour order with amazon
regex.icontainsregexyour password has been compromised
sender.email.domain.root_domainmemberwise.com
sender.email.domain.root_domainmemberwise.jobs
sender.email.domain.root_domainmembersplitwise.com
sender.email.domain.root_domainmemberconnectwise.com