Detection rules › Sublime MQL
Service abuse: Cisco secure email service with financial request
Detects messages abusing Cisco's secure email service (res.cisco.com) that contain financial topics or invoice requests, with mismatched reply-to domains and undisclosed recipients.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Impersonation: Brand, Social engineering, Evasion |
Event coverage
Rule body MQL
type.inbound
and sender.email.domain.domain == 'res.cisco.com'
and any(headers.reply_to, .email.domain.domain != 'res.cisco.com')
and (
length(recipients.to) == 0
or all(recipients.to, .display_name == "Undisclosed recipients")
)
and (
any(ml.nlu_classifier(body.current_thread.text).topics,
.name in ("Financial Communications", "Request to View Invoice")
)
or any(ml.nlu_classifier(subject.base).entities, .name == "financial")
)
Detection logic
Scope: inbound message.
Detects messages abusing Cisco's secure email service (res.cisco.com) that contain financial topics or invoice requests, with mismatched reply-to domains and undisclosed recipients.
- inbound message
- sender.email.domain.domain is 'res.cisco.com'
any of
headers.reply_towhere:- .email.domain.domain is not 'res.cisco.com'
any of:
- length(recipients.to) is 0
all of
recipients.towhere:- .display_name is 'Undisclosed recipients'
any of:
any of
ml.nlu_classifier(body.current_thread.text).topicswhere:- .name in ('Financial Communications', 'Request to View Invoice')
any of
ml.nlu_classifier(subject.base).entitieswhere:- .name is 'financial'
Inspects: body.current_thread.text, headers.reply_to, headers.reply_to[].email.domain.domain, recipients.to, recipients.to[].display_name, sender.email.domain.domain, subject.base, type.inbound. Sensors: ml.nlu_classifier.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
sender.email.domain.domain | equals | res.cisco.com |
recipients.to[].display_name | equals | Undisclosed recipients |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Financial Communications |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Request to View Invoice |
ml.nlu_classifier(subject.base).entities[].name | equals | financial |