Detection rules › Sublime MQL

Brand impersonation: Zoom (strict)

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Impersonation of the video conferencing provider Zoom. This "strict" version of this rule will only flag when the sender's display name matches those used by Zoom exactly.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Message attribute
sender
sender.email
type

Rule body MQL

type.inbound
and (
  sender.display_name =~ 'zoom'
  or sender.display_name =~ 'zoom video communications, inc.'
  or sender.display_name =~ 'zoom call'
)
and sender.email.domain.root_domain not in (
  'zoom.us',
  'zuora.com',
  'zoomgov.com',
  'zoom.com'
)
and (
  // if this comes from a free email provider,
  // flag if org has never sent an email to sender's email before
  (
    sender.email.domain.root_domain in $free_email_providers
    and not profile.by_sender().solicited
  )
  // if this comes from a custom domain,
  // flag if org has never sent an email to sender's domain before
  or (
    sender.email.domain.root_domain not in $free_email_providers
    and not profile.by_sender().solicited
  )
)

Detection logic

Scope: inbound message.

Impersonation of the video conferencing provider Zoom. This "strict" version of this rule will only flag when the sender's display name matches those used by Zoom exactly.

  1. inbound message
  2. any of:
    • sender.display_name is 'zoom'
    • sender.display_name is 'zoom video communications, inc.'
    • sender.display_name is 'zoom call'
  3. sender.email.domain.root_domain not in ('zoom.us', 'zuora.com', 'zoomgov.com', 'zoom.com')
  4. any of:
    • all of:
      • sender.email.domain.root_domain in $free_email_providers
      • not:
        • profile.by_sender().solicited
    • all of:
      • sender.email.domain.root_domain not in $free_email_providers
      • not:
        • profile.by_sender().solicited

Inspects: sender.display_name, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender. Reference lists: $free_email_providers.

Indicators matched (7)

FieldMatchValue
sender.display_nameequalszoom
sender.display_nameequalszoom video communications, inc.
sender.display_nameequalszoom call
sender.email.domain.root_domainmemberzoom.us
sender.email.domain.root_domainmemberzuora.com
sender.email.domain.root_domainmemberzoomgov.com
sender.email.domain.root_domainmemberzoom.com