Detection rules › Sublime MQL

Observed IOC: Malicious sender root domains

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages sent from known malicious sender root domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing, Malware/Ransomware
Tactics and techniquesImpersonation: Domain, Social engineering

Event coverage

Message attribute
sender.email
type

Rule body MQL

// AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
// Managed by automated IOC system
type.inbound
and hash.sha256(sender.email.domain.root_domain) in (
  '0d5c8fb81fbe42f919341fc80f73437d1077d70f9da986e5719bd68274b42626', // Brand impersonation giveaways with AFF
  '3e09e73578196179a054606834b0cd7172a619f5e4702f2424dfbd0ab4d79786', // Brand impersonation giveaways with AFF
  '62241b7477485898cdb45d9814693e9cb4989ee7bd65c2c3e205a91b84cf3fec', // Brand impersonation giveaways with AFF
  '674b7cb4df4d9e115dd57ad0eb8227f6bb7719ef596c17a7443883718632c6ff', // Brand impersonation giveaways with AFF
  '724eba9594f52e2aeaed2e58926f8c52048accc44a15ecc0bdb5a0a101dbc268', // Brand impersonation giveaways with AFF
  '91d0721e7cf3646224f8e95f6b5582b83a13c483eb56423bfb585af6392df11b', // Brand impersonation giveaways with AFF
  'a8c8b0ee7c69c310e54d8710c3575a9e1de9a2950e6ed1806c1fe60e6cb63d36', // Brand impersonation giveaways with AFF
  'ae7ef98abc59eabb4d6ee22444c16d791f49505ea657c37f4ff5846b273cb30d', // Brand impersonation giveaways with AFF
  'e1bbb6342ed70324f41fd3b3e5f6694f28af4aa24bac67b6634daecf18acbc78', // Brand impersonation giveaways with AFF
  'e4beaafe95cdcf3d596eefa2006e77eb826efae12a693fdf83c6c8c43d92c29f' // Brand impersonation giveaways with AFF
)

Detection logic

Scope: inbound message.

Detects inbound messages sent from known malicious sender root domains. IOC list is automatically managed and hashed by the IOC pipeline from the private threat intelligence feed.

  1. inbound message
  2. hash.sha256(sender.email.domain.root_domain) in ('0d5c8fb81fbe42f919341fc80f73437d1077d70f9da986e5719bd68274b42626', '3e09e73578196179a054606834b0cd7172a619f5e4702f2424dfbd0ab4d79786', '62241b7477485898cdb45d9814693e9cb4989ee7bd65c2c3e205a91b84cf3fec', '674b7cb4df4d9e115dd57ad0eb8227f6bb7719ef596c17a7443883718632c6ff', '724eba9594f52e2aeaed2e58926f8c52048accc44a15ecc0bdb5a0a101dbc268', '91d0721e7cf3646224f8e95f6b5582b83a13c483eb56423bfb585af6392df11b', 'a8c8b0ee7c69c310e54d8710c3575a9e1de9a2950e6ed1806c1fe60e6cb63d36', 'ae7ef98abc59eabb4d6ee22444c16d791f49505ea657c37f4ff5846b273cb30d', 'e1bbb6342ed70324f41fd3b3e5f6694f28af4aa24bac67b6634daecf18acbc78', 'e4beaafe95cdcf3d596eefa2006e77eb826efae12a693fdf83c6c8c43d92c29f')

Inspects: sender.email.domain.root_domain, type.inbound. Sensors: hash.sha256.