detection.wiki

Detection rules › Sublime MQL

Punycode sender domain

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

The sender's domain contains punycode, a technique used by attackers to impersonate legitimate domains.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesEvasion, Lookalike domain, Punycode, Social engineering

Event coverage

Message attribute
sender.email
type

Rule body MQL

type.inbound
and strings.ilike(sender.email.domain.domain, "*xn--*")

Detection logic

Scope: inbound message.

The sender's domain contains punycode, a technique used by attackers to impersonate legitimate domains.

  1. inbound message
  2. sender.email.domain.domain matches '*xn--*'

Inspects: sender.email.domain.domain, type.inbound. Sensors: strings.ilike.

Indicators matched (1)

FieldMatchValue
strings.ilikesubstring*xn--*