Detection rules › Sublime MQL
Suspected lookalike domain with suspicious language
This rule identifies messages where links use typosquatting or lookalike domains similar to the sender domain, with at least one domain being either unregistered or recently registered (≤90 days). The messages must also contain indicators of business email compromise (BEC), credential theft, or abusive language patterns like financial terms or polite phrasing such as kindly. This layered approach targets phishing attempts combining domain deception with manipulative content
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Evasion, Lookalike domain, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.current_thread |
| body.links (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
// levenshtein distance (edit distance) between the SLD of the link and the sender domain is greater than 0 and less than or equal to 2.
// This detects typosquatting or domains that are deceptively similar to the sender.
and any(body.links,
length(.href_url.domain.sld) > 3
and 0 < strings.levenshtein(.href_url.domain.sld,
sender.email.domain.sld
) <= 2
// exclude onmicrosoft.com
and not sender.email.domain.root_domain == "onmicrosoft.com"
and (
// domains are not registered or registered within 90d
// network.whois(.href_url.domain).found == false
network.whois(.href_url.domain).days_old <= 90
or network.whois(sender.email.domain).found == false
or network.whois(sender.email.domain).days_old <= 90
)
)
// the mesasge is intent is BEC or Cred Theft, or is talking about financial invoicing/banking language, or a request contains "kindly"
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name in ("bec", "cred_theft")
or any(ml.nlu_classifier(body.current_thread.text).entities,
.name == "financial"
and (
.text in ("invoice", "banking information")
or .name == "request" and strings.icontains(.text, "kindly")
)
)
)
Detection logic
Scope: inbound message.
This rule identifies messages where links use typosquatting or lookalike domains similar to the sender domain, with at least one domain being either unregistered or recently registered (≤90 days). The messages must also contain indicators of business email compromise (BEC), credential theft, or abusive language patterns like financial terms or polite phrasing such as kindly. This layered approach targets phishing attempts combining domain deception with manipulative content
- inbound message
any of
body.linkswhere all hold:- length(.href_url.domain.sld) > 3
all of:
- strings.levenshtein(.href_url.domain.sld) > 0
- strings.levenshtein(.href_url.domain.sld) ≤ 2
not:
- sender.email.domain.root_domain is 'onmicrosoft.com'
any of:
- network.whois(.href_url.domain).days_old ≤ 90
- network.whois(sender.email.domain).found is False
- network.whois(sender.email.domain).days_old ≤ 90
any of
ml.nlu_classifier(body.current_thread.text).intentswhere any holds:- .name in ('bec', 'cred_theft')
any of
ml.nlu_classifier(body.current_thread.text).entitieswhere all hold:- .name is 'financial'
any of:
- .text in ('invoice', 'banking information')
all of:
- .name is 'request'
- .text contains 'kindly'
Inspects: body.current_thread.text, body.links, body.links[].href_url.domain, body.links[].href_url.domain.sld, sender.email.domain, sender.email.domain.root_domain, sender.email.domain.sld, type.inbound. Sensors: ml.nlu_classifier, network.whois, strings.icontains, strings.levenshtein.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | equals | onmicrosoft.com |
ml.nlu_classifier(body.current_thread.text).intents[].name | member | bec |
ml.nlu_classifier(body.current_thread.text).intents[].name | member | cred_theft |
ml.nlu_classifier(body.current_thread.text).entities[].name | equals | financial |
ml.nlu_classifier(body.current_thread.text).entities[].text | member | invoice |
ml.nlu_classifier(body.current_thread.text).entities[].text | member | banking information |
ml.nlu_classifier(body.current_thread.text).entities[].name | equals | request |
strings.icontains | substring | kindly |