Detection rules › Sublime MQL
Sublime MQL rules: shipping
Fraudulent order confirmation/shipping notification from Chinese sender domain
#Detects an order confirmation/shipping notification from a suspicious sender domain based in China. The order may be legitimately placed by the user, but the store is fraudulent and it is unlikely that their order will arrive. Links to these e-commerce sites have been observed in online advertising. We recommend enabling a custom warning banner to alert users and prompt them to contact their bank to recover their funds.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Social engineering |
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Sublime | Inbound email message |
Message attributes
bodybody.current_threadheadersheaders.reply_torecipientssender.emailtype
Rule body
type.inbound
// direct to recipient
and length(recipients.to) == 1
and length(body.previous_threads) == 0
// Known patterns
and (sender.display_name is null or sender.email.local_part == "support")
and all(headers.reply_to,
.email.domain.root_domain == sender.email.domain.root_domain
)
// Alibaba Cloud nameservers
and length(network.whois(sender.email.domain).name_servers) > 0
and all(network.whois(sender.email.domain).name_servers,
.root_domain == "hichina.com"
)
// Shipping notification
and any(ml.nlu_classifier(body.current_thread.text).topics,
.name in ('Shipping and Package', "Order Confirmations")
)
Detection logic
Scope: inbound message.
Detects an order confirmation/shipping notification from a suspicious sender domain based in China. The order may be legitimately placed by the user, but the store is fraudulent and it is unlikely that their order will arrive. Links to these e-commerce sites have been observed in online advertising. We recommend enabling a custom warning banner to alert users and prompt them to contact their bank to recover their funds.
- inbound message
- length(recipients.to) is 1
- length(body.previous_threads) is 0
any of:
- sender.display_name is missing
- sender.email.local_part is 'support'
all of
headers.reply_towhere:- .email.domain.root_domain is sender.email.domain.root_domain
- length(network.whois(sender.email.domain).name_servers) > 0
all of
network.whois(sender.email.domain).name_serverswhere:- .root_domain is 'hichina.com'
any of
ml.nlu_classifier(body.current_thread.text).topicswhere:- .name in ('Shipping and Package', 'Order Confirmations')
Inspects: body.current_thread.text, body.previous_threads, headers.reply_to, headers.reply_to[].email.domain.root_domain, recipients.to, sender.display_name, sender.email.domain, sender.email.domain.root_domain, sender.email.local_part, type.inbound. Sensors: ml.nlu_classifier, network.whois.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
sender.email.local_part | equals | support |
network.whois(sender.email.domain).name_servers[].root_domain | equals | hichina.com |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Shipping and Package |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Order Confirmations |
Stages and Predicates
Stage 1: mql_rule
and
any(ml.nlu_classifier(body.current_thread.text).topics)
ml.nlu_classifier(body.current_thread.text).topics.name in ["Order Confirmations", "Shipping and Package"]
or
sender.display_name is_null
sender.email.local_part eq "support"
body.previous_threads length_compare "0"
network.whois(sender.email.domain).name_servers length_compare "0"
recipients.to length_compare "1"
type.inbound eq "true"
macro "all(headers.reply_to)"
macro "all(network.whois(sender.email.domain).name_servers)"Indicators
These rows show field, operator, and value matches.