Detection rules › Sublime MQL

Hardbacon infrastructure abuse

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Hardbacon is a defunct Canadian budgeting app. Attackers have been observed using their marketing platform to send credential phishing messages.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Impersonation: Brand, Social engineering

Event coverage

Rule body MQL

type.inbound
and sender.email.domain.root_domain in ('hardbacon.com', 'hardbacon.ca')
and headers.mailer == 'Sendinblue'
and headers.auth_summary.dmarc.pass
and headers.auth_summary.spf.pass

Detection logic

Scope: inbound message.

Hardbacon is a defunct Canadian budgeting app. Attackers have been observed using their marketing platform to send credential phishing messages.

  1. inbound message
  2. sender.email.domain.root_domain in ('hardbacon.com', 'hardbacon.ca')
  3. headers.mailer is 'Sendinblue'
  4. headers.auth_summary.dmarc.pass
  5. headers.auth_summary.spf.pass

Inspects: headers.auth_summary.dmarc.pass, headers.auth_summary.spf.pass, headers.mailer, sender.email.domain.root_domain, type.inbound.

Indicators matched (3)

FieldMatchValue
sender.email.domain.root_domainmemberhardbacon.com
sender.email.domain.root_domainmemberhardbacon.ca
headers.mailerequalsSendinblue