Detection rules › Sublime MQL
Sender name contains Active Directory distinguished name
Sender's display name contains an Active Directory distinguished name or a similar string. This has been observed as a malicious indicator in the wild.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
Event coverage
| Message attribute |
|---|
| headers.auth_summary |
| sender |
| sender.email |
| type |
Rule body MQL
type.inbound
and (
regex.icontains(sender.display_name, '\b(EX|LABS|OU|CN|EXCHANGE)(=|/)')
or strings.icontains(sender.display_name, "/O=EXCHANGELABS")
)
and sender.email.domain.root_domain not in $org_domains
and not (
sender.email.domain.root_domain in ('fnfcorp.com')
and headers.auth_summary.dmarc.pass
)
Detection logic
Scope: inbound message.
Sender's display name contains an Active Directory distinguished name or a similar string. This has been observed as a malicious indicator in the wild.
- inbound message
any of:
- sender.display_name matches '\\b(EX|LABS|OU|CN|EXCHANGE)(=|/)'
- sender.display_name contains '/O=EXCHANGELABS'
- sender.email.domain.root_domain not in $org_domains
not:
all of:
- sender.email.domain.root_domain in ('fnfcorp.com')
- headers.auth_summary.dmarc.pass
Inspects: headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.root_domain, type.inbound. Sensors: regex.icontains, strings.icontains. Reference lists: $org_domains.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | \b(EX|LABS|OU|CN|EXCHANGE)(=|/) |
strings.icontains | substring | /O=EXCHANGELABS |
sender.email.domain.root_domain | member | fnfcorp.com |