Detection rules › Sublime MQL
Service abuse: Elastic alerts extortion
Detects inbound messages impersonating Elastic alerts sender that contain extortion content identified through natural language processing with medium to high confidence.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Extortion |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.email == "noreply@alerts.elastic.co"
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "extortion" and .confidence != "low"
)
Detection logic
Scope: inbound message.
Detects inbound messages impersonating Elastic alerts sender that contain extortion content identified through natural language processing with medium to high confidence.
- inbound message
- sender.email.email is 'noreply@alerts.elastic.co'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'extortion'
- .confidence is not 'low'
Inspects: body.current_thread.text, sender.email.email, type.inbound. Sensors: ml.nlu_classifier.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
sender.email.email | equals | noreply@alerts.elastic.co |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | extortion |