detection.wiki

Detection rules › Sublime MQL

Display Name Emoji with Financial Symbols

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages where the sender's display name contains emoji characters alongside financial symbols ($ £ € ¥ ₿) in the subject line. The sender's domain is not present in the Alexa top 1 million sites and has DMARC authentication issues.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Callback Phishing
Tactics and techniquesSocial engineering, Evasion

Event coverage

Message attribute
headers.auth_summary
sender
sender.email
subject
type

Rule body MQL

type.inbound
// Check for emoji in sender display name using Unicode ranges
and regex.contains(sender.display_name,
                   '[\x{1F600}-\x{1F64F}]|[\x{1F300}-\x{1F5FF}]|[\x{1F680}-\x{1F6FF}]|[\x{1F1E0}-\x{1F1FF}]|[\x{2600}-\x{26FF}]|[\x{2700}-\x{27BF}]'
)
// Check for financial symbols in subject
and regex.contains(subject.subject, '[\$£€¥₿]')
and (
  headers.auth_summary.dmarc.pass is null
  or headers.auth_summary.dmarc.pass == false
)
and sender.email.domain.root_domain not in $alexa_1m

Detection logic

Scope: inbound message.

Detects messages where the sender's display name contains emoji characters alongside financial symbols ($ £ € ¥ ₿) in the subject line. The sender's domain is not present in the Alexa top 1 million sites and has DMARC authentication issues.

  1. inbound message
  2. sender.display_name matches '[\\x{1F600}-\\x{1F64F}]|[\\x{1F300}-\\x{1F5FF}]|[\\x{1F680}-\\x{1F6FF}]|[\\x{1F1E0}-\\x{1F1FF}]|[\\x{2600}-\\x{26FF}]|[\\x{2700}-\\x{27BF}]'
  3. subject.subject matches '[\\$£€¥₿]'
  4. any of:
    • headers.auth_summary.dmarc.pass is missing
    • headers.auth_summary.dmarc.pass is False
  5. sender.email.domain.root_domain not in $alexa_1m

Inspects: headers.auth_summary.dmarc.pass, sender.display_name, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: regex.contains. Reference lists: $alexa_1m.

Indicators matched (2)

FieldMatchValue
regex.containsregex[\x{1F600}-\x{1F64F}]|[\x{1F300}-\x{1F5FF}]|[\x{1F680}-\x{1F6FF}]|[\x{1F1E0}-\x{1F1FF}]|[\x{2600}-\x{26FF}]|[\x{2700}-\x{27BF}]
regex.containsregex[\$£€¥₿]