detection.wiki

Detection rules › Sublime MQL

Brand spoof: Dropbox

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Impersonation of Dropbox, a file sharing service; specifically spoofs the Dropbox sender domain.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesImpersonation: Brand, Spoofing

Event coverage

Message attribute
headers (collection)
headers.auth_summary
sender.email
type

Rule body MQL

type.inbound
and sender.email.domain.root_domain == 'dropbox.com'
and not headers.auth_summary.dmarc.pass
// mitigates situations where an ESG misconfiguration could cause auth failures
and not strings.ends_with(headers.message_id, ".dropbox.com>")

Detection logic

Scope: inbound message.

Impersonation of Dropbox, a file sharing service; specifically spoofs the Dropbox sender domain.

  1. inbound message
  2. sender.email.domain.root_domain is 'dropbox.com'
  3. not:
    • headers.auth_summary.dmarc.pass
  4. not:
    • headers.message_id ends with '.dropbox.com>'

Inspects: headers.auth_summary.dmarc.pass, headers.message_id, sender.email.domain.root_domain, type.inbound. Sensors: strings.ends_with.

Indicators matched (2)

FieldMatchValue
sender.email.domain.root_domainequalsdropbox.com
strings.ends_withsuffix.dropbox.com>