Detection rules › Sublime MQL
Brand impersonation: Zoom (strict)
Impersonation of the video conferencing provider Zoom. This "strict" version of this rule will only flag when the sender's display name matches those used by Zoom exactly.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| sender |
| sender.email |
| type |
Rule body MQL
type.inbound
and (
sender.display_name =~ 'zoom'
or sender.display_name =~ 'zoom video communications, inc.'
or sender.display_name =~ 'zoom call'
)
and sender.email.domain.root_domain not in (
'zoom.us',
'zuora.com',
'zoomgov.com',
'zoom.com'
)
and (
// if this comes from a free email provider,
// flag if org has never sent an email to sender's email before
(
sender.email.domain.root_domain in $free_email_providers
and not profile.by_sender().solicited
)
// if this comes from a custom domain,
// flag if org has never sent an email to sender's domain before
or (
sender.email.domain.root_domain not in $free_email_providers
and not profile.by_sender().solicited
)
)
Detection logic
Scope: inbound message.
Impersonation of the video conferencing provider Zoom. This "strict" version of this rule will only flag when the sender's display name matches those used by Zoom exactly.
- inbound message
any of:
- sender.display_name is 'zoom'
- sender.display_name is 'zoom video communications, inc.'
- sender.display_name is 'zoom call'
- sender.email.domain.root_domain not in ('zoom.us', 'zuora.com', 'zoomgov.com', 'zoom.com')
any of:
all of:
- sender.email.domain.root_domain in $free_email_providers
not:
- profile.by_sender().solicited
all of:
- sender.email.domain.root_domain not in $free_email_providers
not:
- profile.by_sender().solicited
Inspects: sender.display_name, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender. Reference lists: $free_email_providers.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
sender.display_name | equals | zoom |
sender.display_name | equals | zoom video communications, inc. |
sender.display_name | equals | zoom call |
sender.email.domain.root_domain | member | zoom.us |
sender.email.domain.root_domain | member | zuora.com |
sender.email.domain.root_domain | member | zoomgov.com |
sender.email.domain.root_domain | member | zoom.com |