Detection rules › Sublime MQL
Tax Form: W-8BEN solicitation
Detects messages containing references to W-8BEN tax forms, commonly used in tax-related fraud schemes targeting individuals and businesses.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Social engineering |
Event coverage
Rule body MQL
type.inbound
and (
// few links
0 < length(body.links) < 20
and any(body.links, network.whois(.href_url.domain).days_old <= 60)
// fewer unique root domain links
and length(distinct(body.links, .href_url.domain.root_domain)) < 10
// sender domain matches no body domains
and all(body.links,
.href_url.domain.root_domain != sender.email.domain.root_domain
)
)
// sender domain and return path are the same
and (sender.email.domain.root_domain == headers.return_path.domain.domain)
and not (sender.email.domain.root_domain != headers.return_path.domain.domain)
and (
regex.icontains(subject.subject, ".*Foreign Tax*")
or regex.icontains(subject.subject, ".*W-8BEN*")
)
// or any([body.current_thread.text, body.html.display_text, body.plain.raw],
and any([body.current_thread.text],
regex.icontains(.,
'tax form',
'W-8BEN',
'Foreign Tax',
'tax return',
'tax preparation',
'tax documentation',
'regulatory',
'withholding',
'approve',
'non-US tax',
'treaty',
'Renew Documentation',
'Dear Client'
)
)
// Registrant domain registered to China
and (
any(body.links,
network.whois(.href_url.domain).registrant_country_code =~ "CN"
)
or any(body.links,
strings.icontains(network.whois(.href_url.domain).registrant_country,
"china"
)
)
)
// Alibaba Cloud nameservers
and all(network.whois(sender.email.domain).name_servers,
.root_domain == "hichina.com"
)
Detection logic
Scope: inbound message.
Detects messages containing references to W-8BEN tax forms, commonly used in tax-related fraud schemes targeting individuals and businesses.
- inbound message
all of:
all of:
- length(body.links) > 0
- length(body.links) < 20
any of
body.linkswhere:- network.whois(.href_url.domain).days_old ≤ 60
- length(distinct(body.links, .href_url.domain.root_domain)) < 10
all of
body.linkswhere:- .href_url.domain.root_domain is not sender.email.domain.root_domain
- sender.email.domain.root_domain is headers.return_path.domain.domain
not:
- sender.email.domain.root_domain is not headers.return_path.domain.domain
any of:
- subject.subject matches '.*Foreign Tax*'
- subject.subject matches '.*W-8BEN*'
any of
[body.current_thread.text]where:. matches any of 13 patterns
tax formW-8BENForeign Taxtax returntax preparationtax documentationregulatorywithholdingapprovenon-US taxtreatyRenew DocumentationDear Client
any of:
any of
body.linkswhere:- network.whois(.href_url.domain).registrant_country_code is 'CN'
any of
body.linkswhere:- network.whois(.href_url.domain).registrant_country contains 'china'
all of
network.whois(sender.email.domain).name_serverswhere:- .root_domain is 'hichina.com'
Inspects: body.current_thread.text, body.links, body.links[].href_url.domain, body.links[].href_url.domain.root_domain, headers.return_path.domain.domain, sender.email.domain, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: network.whois, regex.icontains, strings.icontains.
Indicators matched (17)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | .*Foreign Tax* |
regex.icontains | regex | .*W-8BEN* |
regex.icontains | regex | tax form |
regex.icontains | regex | W-8BEN |
regex.icontains | regex | Foreign Tax |
regex.icontains | regex | tax return |
regex.icontains | regex | tax preparation |
regex.icontains | regex | tax documentation |
regex.icontains | regex | regulatory |
regex.icontains | regex | withholding |
regex.icontains | regex | approve |
regex.icontains | regex | non-US tax |
5 more
regex.icontains | regex | treaty |
regex.icontains | regex | Renew Documentation |
regex.icontains | regex | Dear Client |
strings.icontains | substring | china |
network.whois(sender.email.domain).name_servers[].root_domain | equals | hichina.com |