Detection rules › Sublime MQL
Fraudulent order confirmation/shipping notification from Chinese sender domain
Detects an order confirmation/shipping notification from a suspicious sender domain based in China. The order may be legitimately placed by the user, but the store is fraudulent and it is unlikely that their order will arrive. Links to these e-commerce sites have been observed in online advertising. We recommend enabling a custom warning banner to alert users and prompt them to contact their bank to recover their funds.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Social engineering |
Event coverage
Rule body MQL
type.inbound
// direct to recipient
and length(recipients.to) == 1
and length(body.previous_threads) == 0
// Known patterns
and (sender.display_name is null or sender.email.local_part == "support")
and all(headers.reply_to,
.email.domain.root_domain == sender.email.domain.root_domain
)
// Alibaba Cloud nameservers
and length(network.whois(sender.email.domain).name_servers) > 0
and all(network.whois(sender.email.domain).name_servers,
.root_domain == "hichina.com"
)
// Shipping notification
and any(ml.nlu_classifier(body.current_thread.text).topics,
.name in ('Shipping and Package', "Order Confirmations")
)
Detection logic
Scope: inbound message.
Detects an order confirmation/shipping notification from a suspicious sender domain based in China. The order may be legitimately placed by the user, but the store is fraudulent and it is unlikely that their order will arrive. Links to these e-commerce sites have been observed in online advertising. We recommend enabling a custom warning banner to alert users and prompt them to contact their bank to recover their funds.
- inbound message
- length(recipients.to) is 1
- length(body.previous_threads) is 0
any of:
- sender.display_name is missing
- sender.email.local_part is 'support'
all of
headers.reply_towhere:- .email.domain.root_domain is sender.email.domain.root_domain
- length(network.whois(sender.email.domain).name_servers) > 0
all of
network.whois(sender.email.domain).name_serverswhere:- .root_domain is 'hichina.com'
any of
ml.nlu_classifier(body.current_thread.text).topicswhere:- .name in ('Shipping and Package', 'Order Confirmations')
Inspects: body.current_thread.text, body.previous_threads, headers.reply_to, headers.reply_to[].email.domain.root_domain, recipients.to, sender.display_name, sender.email.domain, sender.email.domain.root_domain, sender.email.local_part, type.inbound. Sensors: ml.nlu_classifier, network.whois.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
sender.email.local_part | equals | support |
network.whois(sender.email.domain).name_servers[].root_domain | equals | hichina.com |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Shipping and Package |
ml.nlu_classifier(body.current_thread.text).topics[].name | member | Order Confirmations |