Detection rules › Sublime MQL

Invoicera infrastructure abuse

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule is tailored to flag infrastructural abuse involving Invoicera, a SaaS-based invoicing and billing platform, which has been identified as a tool in widespread spam and credential phishing campaigns.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Spam
Tactics and techniquesFree file host, Free subdomain host, Image as content, Social engineering

Event coverage

Rule body MQL

type.inbound
and sender.email.domain.root_domain == "invoicera.com"
// suspicious recipient pattern
and (
  length(recipients.to) == 0
  or any(recipients.to, .email.domain.valid == false)
  or length(recipients.bcc) > 0
)
// suspicious link
and (
  any(body.links,
      .href_url.domain.root_domain in $free_file_hosts
      or .href_url.domain.domain in $free_file_hosts
  )
  or any(body.links,
         .href_url.domain.root_domain in $free_subdomain_hosts
         and .href_url.domain.subdomain is not null
         and .href_url.domain.subdomain != "www"
  )
)
// mismatched reply-to
and (
  headers.return_path.email is not null
  and headers.return_path.email != sender.email.email
)

Detection logic

Scope: inbound message.

This rule is tailored to flag infrastructural abuse involving Invoicera, a SaaS-based invoicing and billing platform, which has been identified as a tool in widespread spam and credential phishing campaigns.

  1. inbound message
  2. sender.email.domain.root_domain is 'invoicera.com'
  3. any of:
    • length(recipients.to) is 0
    • any of recipients.to where:
      • .email.domain.valid is False
    • length(recipients.bcc) > 0
  4. any of:
    • any of body.links where any holds:
      • .href_url.domain.root_domain in $free_file_hosts
      • .href_url.domain.domain in $free_file_hosts
    • any of body.links where all hold:
      • .href_url.domain.root_domain in $free_subdomain_hosts
      • .href_url.domain.subdomain is set
      • .href_url.domain.subdomain is not 'www'
  5. all of:
    • headers.return_path.email is set
    • headers.return_path.email is not sender.email.email

Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.subdomain, headers.return_path.email, recipients.bcc, recipients.to, recipients.to[].email.domain.valid, sender.email.domain.root_domain, sender.email.email, type.inbound. Reference lists: $free_file_hosts, $free_subdomain_hosts.

Indicators matched (1)

FieldMatchValue
sender.email.domain.root_domainequalsinvoicera.com