Detection rules › Sublime MQL

Sublime MQL rules: spoof

Rule	Severity
Brand spoof: Dropbox	`medium`

Brand spoof: Dropbox

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

Impersonation of Dropbox, a file sharing service; specifically spoofs the Dropbox sender domain.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing, Malware/Ransomware
Tactics and techniques	Impersonation: Brand, Spoofing

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

headers
headers.auth_summary
sender.email
type

Rule body

type.inbound
and sender.email.domain.root_domain == 'dropbox.com'
and not headers.auth_summary.dmarc.pass
// mitigates situations where an ESG misconfiguration could cause auth failures
and not strings.ends_with(headers.message_id, ".dropbox.com>")

Detection logic

Scope: inbound message.

Impersonation of Dropbox, a file sharing service; specifically spoofs the Dropbox sender domain.

inbound message
sender.email.domain.root_domain is 'dropbox.com'
not:
- headers.auth_summary.dmarc.pass
not:
- headers.message_id ends with '.dropbox.com>'

Inspects: headers.auth_summary.dmarc.pass, headers.message_id, sender.email.domain.root_domain, type.inbound. Sensors: strings.ends_with.

Indicators matched (1)

Field	Match	Value
`sender.email.domain.root_domain`	equals	`dropbox.com`

Stages and Predicates

Stage 1: `mql_rule`

and
  not
    headers.auth_summary.dmarc.pass eq "true"
  not
    headers.message_id ends_with ".dropbox.com>"
  sender.email.domain.root_domain eq "dropbox.com"
  type.inbound eq "true"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`headers.auth_summary.dmarc.pass`	eq	`true`	`excludes:headers.auth_summary.dmarc.pass` `field:"headers.auth_summary.dmarc.pass" value:"true"`
`headers.message_id`	ends_with	`.dropbox.com>`	`excludes:headers.message_id` `field:"headers.message_id" value:".dropbox.com>"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`sender.email.domain.root_domain`	eq	`dropbox.com`	`field:"sender.email.domain.root_domain" kind:eq value:"dropbox.com"`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`