Detection rules › Sublime MQL

Link: BEC with newly registered domains and financial keywords

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects Business Email Compromise attacks containing links to newly registered domains (less than 60 days old) with invoice-related language and engaging action words. The message includes financial or payment terminology and prompts the recipient to take action through suspicious links. Uses natural language processing to identify credential theft or BEC intent while filtering out benign communications.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud
Tactics and techniquesSocial engineering, Evasion, Spoofing

Event coverage

Rule body MQL

type.inbound
and 0 < length(body.current_thread.links) < 15
and any(body.current_thread.links,
        network.whois(.href_url.domain).days_old < 60
        and regex.icontains(.display_text,
                            '(?:view|click|download|check|validate)'
        )
)
and regex.icontains(subject.base,
                    '\b(?:proposal|purchase|invoice|payment|wire|agreement|contract|settlement)\b'
)
and regex.icontains(body.current_thread.text,
                    '\bwire\b',
                    'payment',
                    'invoice',
                    '\bACH\b',
                    'kindly',
                    'document',
                    'urgent',
                    'confirm'
)
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name in ("cred_theft", "bec") and .confidence != "low"
  )
  or any(ml.nlu_classifier(body.current_thread.text).tags,
         .name in ("invoice", "payment")
  )
)
// prevent benign emails
and not any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == "benign"
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Detection logic

Scope: inbound message.

Detects Business Email Compromise attacks containing links to newly registered domains (less than 60 days old) with invoice-related language and engaging action words. The message includes financial or payment terminology and prompts the recipient to take action through suspicious links. Uses natural language processing to identify credential theft or BEC intent while filtering out benign communications.

  1. inbound message
  2. all of:
    • length(body.current_thread.links) > 0
    • length(body.current_thread.links) < 15
  3. any of body.current_thread.links where all hold:
    • network.whois(.href_url.domain).days_old < 60
    • .display_text matches '(?:view|click|download|check|validate)'
  4. subject.base matches '\\b(?:proposal|purchase|invoice|payment|wire|agreement|contract|settlement)\\b'
  5. body.current_thread.text matches any of 8 patterns
    • \bwire\b
    • payment
    • invoice
    • \bACH\b
    • kindly
    • document
    • urgent
    • confirm
  6. any of:
    • any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
      • .name in ('cred_theft', 'bec')
      • .confidence is not 'low'
    • any of ml.nlu_classifier(body.current_thread.text).tags where:
      • .name in ('invoice', 'payment')
  7. not:
    • any of ml.nlu_classifier(body.current_thread.text).intents where:
      • .name is 'benign'
  8. not:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • coalesce(headers.auth_summary.dmarc.pass)

Inspects: body.current_thread.links, body.current_thread.links[].display_text, body.current_thread.links[].href_url.domain, body.current_thread.text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, subject.base, type.inbound. Sensors: ml.nlu_classifier, network.whois, regex.icontains. Reference lists: $high_trust_sender_root_domains.

Indicators matched (15)

FieldMatchValue
regex.icontainsregex(?:view|click|download|check|validate)
regex.icontainsregex\b(?:proposal|purchase|invoice|payment|wire|agreement|contract|settlement)\b
regex.icontainsregex\bwire\b
regex.icontainsregexpayment
regex.icontainsregexinvoice
regex.icontainsregex\bACH\b
regex.icontainsregexkindly
regex.icontainsregexdocument
regex.icontainsregexurgent
regex.icontainsregexconfirm
ml.nlu_classifier(body.current_thread.text).intents[].namemembercred_theft
ml.nlu_classifier(body.current_thread.text).intents[].namememberbec
3 more
ml.nlu_classifier(body.current_thread.text).tags[].namememberinvoice
ml.nlu_classifier(body.current_thread.text).tags[].namememberpayment
ml.nlu_classifier(body.current_thread.text).intents[].nameequalsbenign