detection.wiki

Detection rules › Sublime MQL

Cyrillic vowel substitutions with suspicious subject from unknown sender

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule detects unsolicited messages with between 1-9 links containing a suspicious subject as well as Cyrillic vowel substitutions detected in either the subject or the senders display name.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Impersonation: Brand, Social engineering

Event coverage

Message attribute
body
headers (collection)
headers.reply_to (collection)
sender
subject
type

Rule body MQL

type.inbound
and 0 < length(body.links) < 10

//  display name or subject contains confusable vowels
and any([subject.subject, sender.display_name],
        regex.icontains(., '(а|е|и|о|у)')
)

// and suspicious subject
and regex.icontains(subject.subject,
                    // https://github.com/sublime-security/static-files/blob/main/suspicious_subjects_regex.txt
                    "termination.*notice",
                    "38417",
                    ":completed",
                    "[il1]{2}mit.*ma[il1]{2} ?bo?x",
                    "[il][il][il]egai[ -]",
                    "[li][li][li]ega[li] attempt",
                    "[ng]-?[io]n .*block",
                    "[ng]-?[io]n .*cancel",
                    "[ng]-?[io]n .*deactiv",
                    "[ng]-?[io]n .*disabl",
                    "action.*required",
                    "abandon.*package",
                    "about.your.account",
                    "acc(ou)?n?t (is )?on ho[li]d",
                    "acc(ou)?n?t.*terminat",
                    "acc(oun)?t.*[il1]{2}mitation",
                    "access.*limitation",
                    "account (will be )?block",
                    "account.*de-?activat",
                    "account.*locked",
                    "account.*re-verification",
                    "account.*security",
                    "account.*suspension",
                    "account.has.been",
                    "account.has.expired",
                    "account.will.be.blocked",
                    "account v[il]o[li]at",
                    "activity.*acc(oun)?t",
                    "almost.full",
                    "app[li]e.[il]d",
                    "authenticate.*account",
                    "been.*suspend",
                    "clos.*of.*account.*processed",
                    "confirm.your.account",
                    "courier.*able",
                    "crediential.*notif",
                    "deactivation.*in.*progress",
                    "delivery.*attempt.*failed",
                    "document.received",
                    "documented.*shared.*with.*you",
                    "dropbox.*document",
                    "e-?ma[il1]+ .{010}suspen",
                    "e-?ma[il1]{1} user",
                    "e-?ma[il1]{2} acc",
                    "e-?ma[il1]{2}.*up.?grade",
                    "e.?ma[il1]{2}.*server",
                    "e.?ma[il1]{2}.*suspend",
                    "email.update",
                    "faxed you",
                    "fraud(ulent)?.*charge",
                    "from.helpdesk",
                    "fu[il1]{2}.*ma[il1]+[ -]?box",
                    "has.been.*suspended",
                    "has.been.limited",
                    "have.locked",
                    "he[li]p ?desk upgrade",
                    "heipdesk",
                    "i[il]iega[il]",
                    "ii[il]ega[il]",
                    "incoming e?mail",
                    "incoming.*fax",
                    "lock.*security",
                    "ma[il1]{1}[ -]?box.*quo",
                    "ma[il1]{2}[ -]?box.*fu[il1]",
                    "ma[il1]{2}box.*[il1]{2}mit",
                    "ma[il1]{2}box stor",
                    "mail on.?hold",
                    "mail.*box.*migration",
                    "mail.*de-?activat",
                    "mail.update.required",
                    "mails.*pending",
                    "messages.*pending",
                    "missed.*shipping.*notification",
                    "missed.shipment.notification",
                    "must.update.your.account",
                    "new [sl][io]g?[nig][ -]?in from",
                    "new voice ?-?mail",
                    "notifications.*pending",
                    "office.*3.*6.*5.*suspend",
                    "office365",
                    "on google docs with you",
                    "online doc",
                    "password.*compromised",
                    "periodic maintenance",
                    "potential(ly)? unauthorized",
                    "refund not approved",
                    "revised.*policy",
                    "scam",
                    "scanned.?invoice",
                    "secured?.update",
                    "security breach",
                    "securlty",
                    "signed.*delivery",
                    "status of your .{314}? ?delivery",
                    "susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty",
                    "suspicious.*sign.*[io]n",
                    "suspicious.activit",
                    "temporar(il)?y deactivate",
                    "temporar[il1]{2}y disab[li]ed",
                    "temporarily.*lock",
                    "un-?usua[li].activity",
                    "unable.*deliver",
                    "unauthorized.*activit",
                    "unauthorized.device",
                    "unauthorized.sign.?in",
                    "unrecognized.*activit",
                    "unrecognized.sign.?in",
                    "unrecognized.*activit",
                    "undelivered message",
                    "unread.*doc",
                    "unusual.activity",
                    "upgrade.*account",
                    "upgrade.notice",
                    "urgent message",
                    "urgent.verification",
                    "v[il1]o[li1]at[il1]on security",
                    "va[il1]{1}date.*ma[il1]{2}[ -]?box",
                    "verification ?-?require",
                    "verification( )?-?need",
                    "verify.your?.account",
                    "web ?-?ma[il1]{2}",
                    "web[ -]?ma[il1]{2}",
                    "will.be.suspended",
                    "your (customer )?account .as",
                    "your.office.365",
                    "your.online.access",

                    // https://github.com/sublime-security/static-files/blob/main/suspicious_subjects.txt
                    "account has been limited",
                    "action required",
                    "almost full",
                    "apd notifi cation",
                    "are you at your desk",
                    "are you available",
                    "attached file to docusign",
                    "banking is temporarily unavailable",
                    "bankofamerica",
                    "closing statement invoice",
                    "completed: docusign",
                    "de-activation of",
                    "delivery attempt",
                    "delivery stopped for shipment",
                    "detected suspicious",
                    "detected suspicious actvity",
                    "docu sign",
                    "document for you",
                    "document has been sent to you via docusign",
                    "document is ready for signature",
                    "docusign",
                    "encrypted message",
                    "failed delivery",
                    "fedex tracking",
                    "file was shared",
                    "freefax",
                    "fwd: due invoice paid",
                    "has shared",
                    "inbox is full",
                    "invitation to comment",
                    "invitation to edit",
                    "invoice due",
                    "left you a message",
                    "message from",
                    "new message",
                    "new voicemail",
                    "on desk",
                    "out of space",
                    "password reset",
                    "payment status",
                    "quick reply",
                    "re: w-2",
                    "required",
                    "required: completed docusign",
                    "ringcentral",
                    "scanned image",
                    "secured files",
                    "secured pdf",
                    "security alert",
                    "new sign-in",
                    "new sign in",
                    "sign-in attempt",
                    "sign in attempt",
                    "staff review",
                    "suspicious activity",
                    "unrecognized login attempt",
                    "upgrade immediately",
                    "urgent",
                    "wants to share",
                    "w2",
                    "you have notifications pending",
                    "your account",
                    "your amazon order",
                    "your document settlement",
                    "your order with amazon",
                    "your password has been compromised",
)

// the message is unsolicited and no false positives
and (
  not profile.by_sender().solicited
  or (
    length(headers.reply_to) > 0
    and all(headers.reply_to, .email.email not in $recipient_emails)
  )
)
and not profile.by_sender().any_messages_benign

Detection logic

Scope: inbound message.

This rule detects unsolicited messages with between 1-9 links containing a suspicious subject as well as Cyrillic vowel substitutions detected in either the subject or the senders display name.

  1. inbound message
  2. all of:
    • length(body.links) > 0
    • length(body.links) < 10
  3. any of [subject.subject, sender.display_name] where:
    • . matches '(а|е|и|о|у)'
  4. subject.subject matches any of 192 patterns
    • termination.*notice
    • 38417
    • :completed
    • [il1]{2}mit.*ma[il1]{2} ?bo?x
    • [il][il][il]egai[ -]
    • [li][li][li]ega[li] attempt
    • [ng]-?[io]n .*block
    • [ng]-?[io]n .*cancel
    • [ng]-?[io]n .*deactiv
    • [ng]-?[io]n .*disabl
    • action.*required
    • abandon.*package
    • about.your.account
    • acc(ou)?n?t (is )?on ho[li]d
    • acc(ou)?n?t.*terminat
    • acc(oun)?t.*[il1]{2}mitation
    • access.*limitation
    • account (will be )?block
    • account.*de-?activat
    • account.*locked
    • account.*re-verification
    • account.*security
    • account.*suspension
    • account.has.been
    • account.has.expired
    • account.will.be.blocked
    • account v[il]o[li]at
    • activity.*acc(oun)?t
    • almost.full
    • app[li]e.[il]d
    • authenticate.*account
    • been.*suspend
    • clos.*of.*account.*processed
    • confirm.your.account
    • courier.*able
    • crediential.*notif
    • deactivation.*in.*progress
    • delivery.*attempt.*failed
    • document.received
    • documented.*shared.*with.*you
    • dropbox.*document
    • e-?ma[il1]+ .{010}suspen
    • e-?ma[il1]{1} user
    • e-?ma[il1]{2} acc
    • e-?ma[il1]{2}.*up.?grade
    • e.?ma[il1]{2}.*server
    • e.?ma[il1]{2}.*suspend
    • email.update
    • faxed you
    • fraud(ulent)?.*charge
    • from.helpdesk
    • fu[il1]{2}.*ma[il1]+[ -]?box
    • has.been.*suspended
    • has.been.limited
    • have.locked
    • he[li]p ?desk upgrade
    • heipdesk
    • i[il]iega[il]
    • ii[il]ega[il]
    • incoming e?mail
    • incoming.*fax
    • lock.*security
    • ma[il1]{1}[ -]?box.*quo
    • ma[il1]{2}[ -]?box.*fu[il1]
    • ma[il1]{2}box.*[il1]{2}mit
    • ma[il1]{2}box stor
    • mail on.?hold
    • mail.*box.*migration
    • mail.*de-?activat
    • mail.update.required
    • mails.*pending
    • messages.*pending
    • missed.*shipping.*notification
    • missed.shipment.notification
    • must.update.your.account
    • new [sl][io]g?[nig][ -]?in from
    • new voice ?-?mail
    • notifications.*pending
    • office.*3.*6.*5.*suspend
    • office365
    • on google docs with you
    • online doc
    • password.*compromised
    • periodic maintenance
    • potential(ly)? unauthorized
    • refund not approved
    • revised.*policy
    • scam
    • scanned.?invoice
    • secured?.update
    • security breach
    • securlty
    • signed.*delivery
    • status of your .{314}? ?delivery
    • susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty
    • suspicious.*sign.*[io]n
    • suspicious.activit
    • temporar(il)?y deactivate
    • temporar[il1]{2}y disab[li]ed
    • temporarily.*lock
    • un-?usua[li].activity
    • unable.*deliver
    • unauthorized.*activit
    • unauthorized.device
    • unauthorized.sign.?in
    • unrecognized.*activit
    • unrecognized.sign.?in
    • unrecognized.*activit
    • undelivered message
    • unread.*doc
    • unusual.activity
    • upgrade.*account
    • upgrade.notice
    • urgent message
    • urgent.verification
    • v[il1]o[li1]at[il1]on security
    • va[il1]{1}date.*ma[il1]{2}[ -]?box
    • verification ?-?require
    • verification( )?-?need
    • verify.your?.account
    • web ?-?ma[il1]{2}
    • web[ -]?ma[il1]{2}
    • will.be.suspended
    • your (customer )?account .as
    • your.office.365
    • your.online.access
    • account has been limited
    • action required
    • almost full
    • apd notifi cation
    • are you at your desk
    • are you available
    • attached file to docusign
    • banking is temporarily unavailable
    • bankofamerica
    • closing statement invoice
    • completed: docusign
    • de-activation of
    • delivery attempt
    • delivery stopped for shipment
    • detected suspicious
    • detected suspicious actvity
    • docu sign
    • document for you
    • document has been sent to you via docusign
    • document is ready for signature
    • docusign
    • encrypted message
    • failed delivery
    • fedex tracking
    • file was shared
    • freefax
    • fwd: due invoice paid
    • has shared
    • inbox is full
    • invitation to comment
    • invitation to edit
    • invoice due
    • left you a message
    • message from
    • new message
    • new voicemail
    • on desk
    • out of space
    • password reset
    • payment status
    • quick reply
    • re: w-2
    • required
    • required: completed docusign
    • ringcentral
    • scanned image
    • secured files
    • secured pdf
    • security alert
    • new sign-in
    • new sign in
    • sign-in attempt
    • sign in attempt
    • staff review
    • suspicious activity
    • unrecognized login attempt
    • upgrade immediately
    • urgent
    • wants to share
    • w2
    • you have notifications pending
    • your account
    • your amazon order
    • your document settlement
    • your order with amazon
    • your password has been compromised
  5. any of:
    • not:
      • profile.by_sender().solicited
    • all of:
      • length(headers.reply_to) > 0
      • all of headers.reply_to where:
        • .email.email not in $recipient_emails
  6. not:
    • profile.by_sender().any_messages_benign

Inspects: body.links, headers.reply_to, headers.reply_to[].email.email, sender.display_name, subject.subject, type.inbound. Sensors: profile.by_sender, regex.icontains. Reference lists: $recipient_emails.

Indicators matched (192)

FieldMatchValue
regex.icontainsregex(а|е|и|о|у)
regex.icontainsregextermination.*notice
regex.icontainsregex38417
regex.icontainsregex:completed
regex.icontainsregex[il1]{2}mit.*ma[il1]{2} ?bo?x
regex.icontainsregex[il][il][il]egai[ -]
regex.icontainsregex[li][li][li]ega[li] attempt
regex.icontainsregex[ng]-?[io]n .*block
regex.icontainsregex[ng]-?[io]n .*cancel
regex.icontainsregex[ng]-?[io]n .*deactiv
regex.icontainsregex[ng]-?[io]n .*disabl
regex.icontainsregexaction.*required
180 more
regex.icontainsregexabandon.*package
regex.icontainsregexabout.your.account
regex.icontainsregexacc(ou)?n?t (is )?on ho[li]d
regex.icontainsregexacc(ou)?n?t.*terminat
regex.icontainsregexacc(oun)?t.*[il1]{2}mitation
regex.icontainsregexaccess.*limitation
regex.icontainsregexaccount (will be )?block
regex.icontainsregexaccount.*de-?activat
regex.icontainsregexaccount.*locked
regex.icontainsregexaccount.*re-verification
regex.icontainsregexaccount.*security
regex.icontainsregexaccount.*suspension
regex.icontainsregexaccount.has.been
regex.icontainsregexaccount.has.expired
regex.icontainsregexaccount.will.be.blocked
regex.icontainsregexaccount v[il]o[li]at
regex.icontainsregexactivity.*acc(oun)?t
regex.icontainsregexalmost.full
regex.icontainsregexapp[li]e.[il]d
regex.icontainsregexauthenticate.*account
regex.icontainsregexbeen.*suspend
regex.icontainsregexclos.*of.*account.*processed
regex.icontainsregexconfirm.your.account
regex.icontainsregexcourier.*able
regex.icontainsregexcrediential.*notif
regex.icontainsregexdeactivation.*in.*progress
regex.icontainsregexdelivery.*attempt.*failed
regex.icontainsregexdocument.received
regex.icontainsregexdocumented.*shared.*with.*you
regex.icontainsregexdropbox.*document
regex.icontainsregexe-?ma[il1]+ .{010}suspen
regex.icontainsregexe-?ma[il1]{1} user
regex.icontainsregexe-?ma[il1]{2} acc
regex.icontainsregexe-?ma[il1]{2}.*up.?grade
regex.icontainsregexe.?ma[il1]{2}.*server
regex.icontainsregexe.?ma[il1]{2}.*suspend
regex.icontainsregexemail.update
regex.icontainsregexfaxed you
regex.icontainsregexfraud(ulent)?.*charge
regex.icontainsregexfrom.helpdesk
regex.icontainsregexfu[il1]{2}.*ma[il1]+[ -]?box
regex.icontainsregexhas.been.*suspended
regex.icontainsregexhas.been.limited
regex.icontainsregexhave.locked
regex.icontainsregexhe[li]p ?desk upgrade
regex.icontainsregexheipdesk
regex.icontainsregexi[il]iega[il]
regex.icontainsregexii[il]ega[il]
regex.icontainsregexincoming e?mail
regex.icontainsregexincoming.*fax
regex.icontainsregexlock.*security
regex.icontainsregexma[il1]{1}[ -]?box.*quo
regex.icontainsregexma[il1]{2}[ -]?box.*fu[il1]
regex.icontainsregexma[il1]{2}box.*[il1]{2}mit
regex.icontainsregexma[il1]{2}box stor
regex.icontainsregexmail on.?hold
regex.icontainsregexmail.*box.*migration
regex.icontainsregexmail.*de-?activat
regex.icontainsregexmail.update.required
regex.icontainsregexmails.*pending
regex.icontainsregexmessages.*pending
regex.icontainsregexmissed.*shipping.*notification
regex.icontainsregexmissed.shipment.notification
regex.icontainsregexmust.update.your.account
regex.icontainsregexnew [sl][io]g?[nig][ -]?in from
regex.icontainsregexnew voice ?-?mail
regex.icontainsregexnotifications.*pending
regex.icontainsregexoffice.*3.*6.*5.*suspend
regex.icontainsregexoffice365
regex.icontainsregexon google docs with you
regex.icontainsregexonline doc
regex.icontainsregexpassword.*compromised
regex.icontainsregexperiodic maintenance
regex.icontainsregexpotential(ly)? unauthorized
regex.icontainsregexrefund not approved
regex.icontainsregexrevised.*policy
regex.icontainsregexscam
regex.icontainsregexscanned.?invoice
regex.icontainsregexsecured?.update
regex.icontainsregexsecurity breach
regex.icontainsregexsecurlty
regex.icontainsregexsigned.*delivery
regex.icontainsregexstatus of your .{314}? ?delivery
regex.icontainsregexsusp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty
regex.icontainsregexsuspicious.*sign.*[io]n
regex.icontainsregexsuspicious.activit
regex.icontainsregextemporar(il)?y deactivate
regex.icontainsregextemporar[il1]{2}y disab[li]ed
regex.icontainsregextemporarily.*lock
regex.icontainsregexun-?usua[li].activity
regex.icontainsregexunable.*deliver
regex.icontainsregexunauthorized.*activit
regex.icontainsregexunauthorized.device
regex.icontainsregexunauthorized.sign.?in
regex.icontainsregexunrecognized.*activit
regex.icontainsregexunrecognized.sign.?in
regex.icontainsregexundelivered message
regex.icontainsregexunread.*doc
regex.icontainsregexunusual.activity
regex.icontainsregexupgrade.*account
regex.icontainsregexupgrade.notice
regex.icontainsregexurgent message
regex.icontainsregexurgent.verification
regex.icontainsregexv[il1]o[li1]at[il1]on security
regex.icontainsregexva[il1]{1}date.*ma[il1]{2}[ -]?box
regex.icontainsregexverification ?-?require
regex.icontainsregexverification( )?-?need
regex.icontainsregexverify.your?.account
regex.icontainsregexweb ?-?ma[il1]{2}
regex.icontainsregexweb[ -]?ma[il1]{2}
regex.icontainsregexwill.be.suspended
regex.icontainsregexyour (customer )?account .as
regex.icontainsregexyour.office.365
regex.icontainsregexyour.online.access
regex.icontainsregexaccount has been limited
regex.icontainsregexaction required
regex.icontainsregexalmost full
regex.icontainsregexapd notifi cation
regex.icontainsregexare you at your desk
regex.icontainsregexare you available
regex.icontainsregexattached file to docusign
regex.icontainsregexbanking is temporarily unavailable
regex.icontainsregexbankofamerica
regex.icontainsregexclosing statement invoice
regex.icontainsregexcompleted: docusign
regex.icontainsregexde-activation of
regex.icontainsregexdelivery attempt
regex.icontainsregexdelivery stopped for shipment
regex.icontainsregexdetected suspicious
regex.icontainsregexdetected suspicious actvity
regex.icontainsregexdocu sign
regex.icontainsregexdocument for you
regex.icontainsregexdocument has been sent to you via docusign
regex.icontainsregexdocument is ready for signature
regex.icontainsregexdocusign
regex.icontainsregexencrypted message
regex.icontainsregexfailed delivery
regex.icontainsregexfedex tracking
regex.icontainsregexfile was shared
regex.icontainsregexfreefax
regex.icontainsregexfwd: due invoice paid
regex.icontainsregexhas shared
regex.icontainsregexinbox is full
regex.icontainsregexinvitation to comment
regex.icontainsregexinvitation to edit
regex.icontainsregexinvoice due
regex.icontainsregexleft you a message
regex.icontainsregexmessage from
regex.icontainsregexnew message
regex.icontainsregexnew voicemail
regex.icontainsregexon desk
regex.icontainsregexout of space
regex.icontainsregexpassword reset
regex.icontainsregexpayment status
regex.icontainsregexquick reply
regex.icontainsregexre: w-2
regex.icontainsregexrequired
regex.icontainsregexrequired: completed docusign
regex.icontainsregexringcentral
regex.icontainsregexscanned image
regex.icontainsregexsecured files
regex.icontainsregexsecured pdf
regex.icontainsregexsecurity alert
regex.icontainsregexnew sign-in
regex.icontainsregexnew sign in
regex.icontainsregexsign-in attempt
regex.icontainsregexsign in attempt
regex.icontainsregexstaff review
regex.icontainsregexsuspicious activity
regex.icontainsregexunrecognized login attempt
regex.icontainsregexupgrade immediately
regex.icontainsregexurgent
regex.icontainsregexwants to share
regex.icontainsregexw2
regex.icontainsregexyou have notifications pending
regex.icontainsregexyour account
regex.icontainsregexyour amazon order
regex.icontainsregexyour document settlement
regex.icontainsregexyour order with amazon
regex.icontainsregexyour password has been compromised