detection.wiki

Detection rules › Sublime MQL

Service Abuse: GoDaddy infrastructure

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages from legitimate GoDaddy domains with suspicious indicators. Observed abused for call back phishing and extortion campaigns.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing, Extortion
Tactics and techniquesEvasion

Event coverage

Message attribute
body
body.current_thread
body.links (collection)
headers.auth_summary
sender
sender.email
subject
type

Rule body MQL

type.inbound
and length(attachments) == 0
// legitimate GoDaddy sending infrastructure
and (
  sender.email.domain.root_domain == "godaddy.com"
  and headers.auth_summary.dmarc.pass
)
and any(body.links, .display_text in~ ("Pay Now", "Accept Access"))
and (
  (
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in~ ("callback_scam", "cred_theft", "extortion")
        and .confidence == "high"
    )
  )
  // manual extortion indicators
  or (
    regex.icontains(sender.display_name,
                    'big(\s|[[:punct:]])?brother|seeing(\s|[[:punct:]])?eye'
    )
    or regex.icontains(body.current_thread.text,
                       '((I|you).{0,25}(leak|compromise|hack|see|record|expose))|(dirty|little) secret'
    )
  )
  // manual callback phishing indicators
  or (
    // phone number in display name or subject
    any([sender.display_name, subject.base],
        regex.icontains(.,
                        '\b\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}\b'
        )
    )
    // references commonly impersonated brands in body
    or strings.ilike(strings.replace_confusables(body.current_thread.text),
                     "*Pay?Pal*",
                     "*Best?Buy*",
                     "*Geek?Squad*",
    )
  )
  // emojis in link display text
  or any(body.links,
         regex.contains(.display_text,
                        '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
         )
  )
  // links leading to cloudflare R2 or edge services
  or any(body.links,
         .href_url.domain.root_domain in~ ("r2.dev", "pages.dev", "workers.dev")
  )
)

Detection logic

Scope: inbound message.

Detects messages from legitimate GoDaddy domains with suspicious indicators. Observed abused for call back phishing and extortion campaigns.

  1. inbound message
  2. length(attachments) is 0
  3. all of:
    • sender.email.domain.root_domain is 'godaddy.com'
    • headers.auth_summary.dmarc.pass
  4. any of body.links where:
    • .display_text in ('Pay Now', 'Accept Access')
  5. any of:
    • any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
      • .name in ('callback_scam', 'cred_theft', 'extortion')
      • .confidence is 'high'
    • any of:
      • sender.display_name matches 'big(\\s|[[:punct:]])?brother|seeing(\\s|[[:punct:]])?eye'
      • body.current_thread.text matches '((I|you).{0,25}(leak|compromise|hack|see|record|expose))|(dirty|little) secret'
    • any of:
      • any of [sender.display_name, subject.base] where:
        • . matches '\\b\\+?([ilo0-9]{1}.)?\\(?[ilo0-9]{3}?\\)?.[ilo0-9]{3}.?[ilo0-9]{4}\\b'
      • strings.replace_confusables(body.current_thread.text) matches any of 3 patterns
        • *Pay?Pal*
        • *Best?Buy*
        • *Geek?Squad*
    • any of body.links where:
      • .display_text matches '[\\x{1F300}-\\x{1F5FF}\\x{1F600}-\\x{1F64F}\\x{1F680}-\\x{1F6FF}\\x{1F700}-\\x{1F77F}\\x{1F780}-\\x{1F7FF}\\x{1F900}-\\x{1F9FF}\\x{2600}-\\x{26FF}\\x{2700}-\\x{27BF}\\x{2300}-\\x{23FF}]'
    • any of body.links where:
      • .href_url.domain.root_domain in ('r2.dev', 'pages.dev', 'workers.dev')

Inspects: body.current_thread.text, body.links, body.links[].display_text, body.links[].href_url.domain.root_domain, headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.root_domain, subject.base, type.inbound. Sensors: ml.nlu_classifier, regex.contains, regex.icontains, strings.ilike, strings.replace_confusables.

Indicators matched (17)

FieldMatchValue
sender.email.domain.root_domainequalsgodaddy.com
body.links[].display_textmemberPay Now
body.links[].display_textmemberAccept Access
ml.nlu_classifier(body.current_thread.text).intents[].namemembercallback_scam
ml.nlu_classifier(body.current_thread.text).intents[].namemembercred_theft
ml.nlu_classifier(body.current_thread.text).intents[].namememberextortion
ml.nlu_classifier(body.current_thread.text).intents[].confidenceequalshigh
regex.icontainsregexbig(\s|[[:punct:]])?brother|seeing(\s|[[:punct:]])?eye
regex.icontainsregex((I|you).{0,25}(leak|compromise|hack|see|record|expose))|(dirty|little) secret
regex.icontainsregex\b\+?([ilo0-9]{1}.)?\(?[ilo0-9]{3}?\)?.[ilo0-9]{3}.?[ilo0-9]{4}\b
strings.ilikesubstring*Pay?Pal*
strings.ilikesubstring*Best?Buy*
5 more
strings.ilikesubstring*Geek?Squad*
regex.containsregex[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]
body.links[].href_url.domain.root_domainmemberr2.dev
body.links[].href_url.domain.root_domainmemberpages.dev
body.links[].href_url.domain.root_domainmemberworkers.dev