Detection rules › Sublime MQL

VIP local_part impersonation from unsolicited sender

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule identifies potential impersonation attempts involving the local part of an $org_vip email address. Specifically, it checks for cases where the local part of an $org_vip email (e.g., local_part@domain.com) appears with a different domain (e.g., local_part@foreigndomain.com). Additionally, the rule flags messages that match an $org_vip address exactly but fail authentication.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Tactics and techniquesImpersonation: VIP, Spoofing

Event coverage

Rule body MQL

type.inbound
and any($org_vips,
        strings.contains(sender.email.local_part, ".")
        and strings.starts_with(.email, sender.email.local_part)
        and (
          sender.email.email != .email
          or (
            sender.email.email == .email and not headers.auth_summary.dmarc.pass
          )
        )
)
and (
  // ignore personal <> work emails
  // where the sender and mailbox's display name are the same
  length(recipients.to) > 0
  or length(recipients.cc) > 0
  or sender.display_name != mailbox.display_name
)
// bounce-back negations
and not strings.like(sender.email.local_part,
                     "*postmaster*",
                     "*mailer-daemon*",
                     "*administrator*"
)

// negate org domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $org_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $org_domains
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
// sender profile
and (
  not profile.by_sender_email().solicited
  or not profile.by_sender_email().any_messages_benign
  or (
    profile.by_sender_email().any_messages_malicious_or_spam
    and not profile.by_sender_email().any_messages_benign
  )
  or (
    sender.email.domain.domain in $org_domains
    and not coalesce(headers.auth_summary.dmarc.pass, false)
  )
)

Detection logic

Scope: inbound message.

This rule identifies potential impersonation attempts involving the local part of an $org_vip email address. Specifically, it checks for cases where the local part of an $org_vip email (e.g., local_part@domain.com) appears with a different domain (e.g., local_part@foreigndomain.com). Additionally, the rule flags messages that match an $org_vip address exactly but fail authentication.

  1. inbound message
  2. any of $org_vips where all hold:
    • sender.email.local_part contains '.'
    • strings.starts_with(.email)
    • any of:
      • sender.email.email is not .email
      • all of:
        • sender.email.email is .email
        • not:
          • headers.auth_summary.dmarc.pass
  3. any of:
    • length(recipients.to) > 0
    • length(recipients.cc) > 0
    • sender.display_name is not mailbox.display_name
  4. not:
    • sender.email.local_part matches any of 3 patterns
      • *postmaster*
      • *mailer-daemon*
      • *administrator*
  5. any of:
    • all of:
      • sender.email.domain.root_domain in $org_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $org_domains
  6. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains
  7. any of:
    • not:
      • profile.by_sender_email().solicited
    • not:
      • profile.by_sender_email().any_messages_benign
    • all of:
      • profile.by_sender_email().any_messages_malicious_or_spam
      • not:
        • profile.by_sender_email().any_messages_benign
    • all of:
      • sender.email.domain.domain in $org_domains
      • not:
        • coalesce(headers.auth_summary.dmarc.pass)

Inspects: headers.auth_summary.dmarc.pass, mailbox.display_name, recipients.cc, recipients.to, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.email, sender.email.local_part, type.inbound. Sensors: profile.by_sender_email, strings.contains, strings.like, strings.starts_with. Reference lists: $high_trust_sender_root_domains, $org_domains, $org_vips.

Indicators matched (4)

FieldMatchValue
strings.containssubstring.
strings.likesubstring*postmaster*
strings.likesubstring*mailer-daemon*
strings.likesubstring*administrator*