detection.wiki

Detection rules › Sublime MQL

Brand impersonation: Discord notification

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages that impersonate Discord's notification system through display name spoofing, domain lookalikes, or logo usage in attachments. The messages contain typical Discord-style notification language in the subject line while failing authentication checks.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Message attribute
attachments (collection)
headers.auth_summary
sender
sender.email
subject
type

Rule body MQL

type.inbound
and (
  strings.ilike(sender.display_name, '*discord*')
  or (
    strings.ilevenshtein(sender.display_name, 'discord') <= 2
    and sender.display_name not in~ ("discogs")
  )
  or strings.ilike(sender.email.domain.domain, '*discord*')
  // Discord logo detection in image attachments
  or any(attachments,
         .file_type in $file_types_images
         and any(ml.logo_detect(.).brands,
                 .name == "Discord" and .confidence != "low"
         )
  )
  // Discord logo detection in message screenshot
  or any(ml.logo_detect(file.message_screenshot()).brands,
         .name == "Discord" and .confidence != "low"
  )
)
and (
  strings.icontains(subject.subject, 'you have received a new notification')
  or regex.icontains(subject.subject,
                     '(?:(?:new|unread|missed|pending|discord)\s+)?(?:message|notification|alert|activity|call) (?:from|waiting|pending)',
  )
  or strings.icontains(subject.subject, 'friend request')
  or strings.icontains(subject.subject, 'server invitation')
  or strings.icontains(subject.subject, 'mentioned you')
  or strings.icontains(subject.subject, 'direct message')
)
and not (
  sender.email.domain.root_domain in ("discord.com", "discogs.com")
  and headers.auth_summary.dmarc.pass
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Detects inbound messages that impersonate Discord's notification system through display name spoofing, domain lookalikes, or logo usage in attachments. The messages contain typical Discord-style notification language in the subject line while failing authentication checks.

  1. inbound message
  2. any of:
    • sender.display_name matches '*discord*'
    • all of:
      • sender.display_name is similar to 'discord'
      • sender.display_name not in ('discogs')
    • sender.email.domain.domain matches '*discord*'
    • any of attachments where all hold:
      • .file_type in $file_types_images
      • any of ml.logo_detect(.).brands where all hold:
        • .name is 'Discord'
        • .confidence is not 'low'
    • any of ml.logo_detect(file.message_screenshot()).brands where all hold:
      • .name is 'Discord'
      • .confidence is not 'low'
  3. any of:
    • subject.subject contains 'you have received a new notification'
    • subject.subject matches '(?:(?:new|unread|missed|pending|discord)\\s+)?(?:message|notification|alert|activity|call) (?:from|waiting|pending)'
    • subject.subject contains 'friend request'
    • subject.subject contains 'server invitation'
    • subject.subject contains 'mentioned you'
    • subject.subject contains 'direct message'
  4. not:
    • all of:
      • sender.email.domain.root_domain in ('discord.com', 'discogs.com')
      • headers.auth_summary.dmarc.pass
  5. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: attachments[].file_type, headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: file.message_screenshot, ml.logo_detect, regex.icontains, strings.icontains, strings.ilevenshtein, strings.ilike. Reference lists: $file_types_images, $high_trust_sender_root_domains.

Indicators matched (13)

FieldMatchValue
strings.ilikesubstring*discord*
strings.ilevenshteinfuzzydiscord
sender.display_namememberdiscogs
ml.logo_detect(attachments[]).brands[].nameequalsDiscord
ml.logo_detect(file.message_screenshot()).brands[].nameequalsDiscord
strings.icontainssubstringyou have received a new notification
regex.icontainsregex(?:(?:new|unread|missed|pending|discord)\s+)?(?:message|notification|alert|activity|call) (?:from|waiting|pending)
strings.icontainssubstringfriend request
strings.icontainssubstringserver invitation
strings.icontainssubstringmentioned you
strings.icontainssubstringdirect message
sender.email.domain.root_domainmemberdiscord.com
1 more
sender.email.domain.root_domainmemberdiscogs.com