Detection rules › Sublime MQL
VIP impersonation: Fake thread with display name match, email mismatch
This rule is intended to detect fake threads that are impersonating a VIP. It looks for a matching $org_vips display name and checks the email address following it does not match what is in the $org_vips list.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Evasion, Impersonation: VIP, Social engineering, Spoofing |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| body.html |
| body.plain |
| headers (collection) |
| type |
Rule body MQL
type.inbound
and any($org_vips,
strings.icontains(body.html.display_text,
strings.concat("From: ", .display_name, " <")
)
and not strings.icontains(body.html.display_text,
strings.concat("From: ",
.display_name,
" <",
.email,
">"
)
)
)
and any([body.current_thread.text, body.html.display_text, body.plain.raw],
3 of (
strings.icontains(., "from:"),
strings.icontains(., "to:"),
strings.icontains(., "sent:"),
strings.icontains(., "date:"),
strings.icontains(., "cc:"),
strings.icontains(., "subject:")
)
)
and (length(headers.references) == 0 or headers.in_reply_to is null)
Detection logic
Scope: inbound message.
This rule is intended to detect fake threads that are impersonating a VIP. It looks for a matching $org_vips display name and checks the email address following it does not match what is in the $org_vips list.
- inbound message
any of
$org_vipswhere all hold:- strings.icontains(body.html.display_text)
not:
- strings.icontains(body.html.display_text)
any of
[body.current_thread.text, body.html.display_text, body.plain.raw]where:at least 3 of 6: . contains any of 6 patterns
from:to:sent:date:cc:subject:
any of:
- length(headers.references) is 0
- headers.in_reply_to is missing
Inspects: body.current_thread.text, body.html.display_text, body.plain.raw, headers.in_reply_to, headers.references, type.inbound. Sensors: strings.concat, strings.icontains. Reference lists: $org_vips.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | from: |
strings.icontains | substring | to: |
strings.icontains | substring | sent: |
strings.icontains | substring | date: |
strings.icontains | substring | cc: |
strings.icontains | substring | subject: |