Detection rules › Sublime MQL
Spam: BlackBaud infrastructure abuse
Malvertising campaign has been observed abusing a compromised account with BlackBaud. These campaigns have been leveraging brands like Disney+, Netflix, Paramount+, Peacock, UPS, and impersonating the likeness of Elon Musk.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
| Tactics and techniques | Evasion, Impersonation: Brand, Image as content, Social engineering |
Event coverage
Rule body MQL
type.inbound
and regex.imatch(sender.email.email, 'communications[a-z]{4,}@.+')
and any(headers.hops, any(.fields, strings.ilike(.name, "x-campaignid")))
and any(headers.domains, strings.contains(.domain, "blackbaud.com"))
and regex.imatch(subject.subject, 'RE\s?:.*')
and (length(headers.references) == 0 or headers.in_reply_to is null)
and any(body.links, .display_text is null)
Detection logic
Scope: inbound message.
Malvertising campaign has been observed abusing a compromised account with BlackBaud. These campaigns have been leveraging brands like Disney+, Netflix, Paramount+, Peacock, UPS, and impersonating the likeness of Elon Musk.
- inbound message
- sender.email.email matches 'communications[a-z]{4,}@.+'
any of
headers.hopswhere:any of
.fieldswhere:- .name matches 'x-campaignid'
any of
headers.domainswhere:- .domain contains 'blackbaud.com'
- subject.subject matches 'RE\\s?:.*'
any of:
- length(headers.references) is 0
- headers.in_reply_to is missing
any of
body.linkswhere:- .display_text is missing
Inspects: body.links, body.links[].display_text, headers.domains, headers.domains[].domain, headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.in_reply_to, headers.references, sender.email.email, subject.subject, type.inbound. Sensors: regex.imatch, strings.contains, strings.ilike.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
regex.imatch | regex | communications[a-z]{4,}@.+ |
strings.ilike | substring | x-campaignid |
strings.contains | substring | blackbaud.com |
regex.imatch | regex | RE\s?:.* |