detection.wiki

Detection rules › Sublime MQL

Lookalike sender domain (untrusted sender)

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Sender's domain is a lookalike of one of your organization's domains and is untrusted.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing, Malware/Ransomware
Tactics and techniquesLookalike domain, Social engineering

Event coverage

Message attribute
headers.auth_summary
sender.email
type

Rule body MQL

type.inbound
and length(sender.email.domain.sld) > 3
and sender.email.domain.domain not in $org_domains
and any($org_domains,
        // this rule can be duplicated in order to tune the threshold
        strings.ilevenshtein(sender.email.domain.domain, .) == 1
)
and (
  (
    profile.by_sender_email().prevalence in ("new", "outlier")
    and not profile.by_sender_email().solicited
  )
  or (
    profile.by_sender_email().any_messages_malicious_or_spam
    and not profile.by_sender_email().any_messages_benign
  )
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender_email().any_messages_benign

Detection logic

Scope: inbound message.

Sender's domain is a lookalike of one of your organization's domains and is untrusted.

  1. inbound message
  2. length(sender.email.domain.sld) > 3
  3. sender.email.domain.domain not in $org_domains
  4. any of $org_domains where:
    • strings.ilevenshtein(sender.email.domain.domain) is 1
  5. any of:
    • all of:
      • profile.by_sender_email().prevalence in ('new', 'outlier')
      • not:
        • profile.by_sender_email().solicited
    • all of:
      • profile.by_sender_email().any_messages_malicious_or_spam
      • not:
        • profile.by_sender_email().any_messages_benign
  6. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains
  7. not:
    • profile.by_sender_email().any_messages_benign

Inspects: headers.auth_summary.dmarc.pass, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.domain.sld, type.inbound. Sensors: profile.by_sender_email, strings.ilevenshtein. Reference lists: $high_trust_sender_root_domains, $org_domains.