Detection rules › Sublime MQL
VIP local_part impersonation from unsolicited sender
This rule identifies potential impersonation attempts involving the local part of an $org_vip email address. Specifically, it checks for cases where the local part of an $org_vip email (e.g., local_part@domain.com) appears with a different domain (e.g., local_part@foreigndomain.com). Additionally, the rule flags messages that match an $org_vip address exactly but fail authentication.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Tactics and techniques | Impersonation: VIP, Spoofing |
Event coverage
| Message attribute |
|---|
| headers.auth_summary |
| mailbox |
| recipients |
| sender |
| sender.email |
| type |
Rule body MQL
type.inbound
and any($org_vips,
strings.contains(sender.email.local_part, ".")
and strings.starts_with(.email, sender.email.local_part)
and (
sender.email.email != .email
or (
sender.email.email == .email and not headers.auth_summary.dmarc.pass
)
)
)
and (
// ignore personal <> work emails
// where the sender and mailbox's display name are the same
length(recipients.to) > 0
or length(recipients.cc) > 0
or sender.display_name != mailbox.display_name
)
// bounce-back negations
and not strings.like(sender.email.local_part,
"*postmaster*",
"*mailer-daemon*",
"*administrator*"
)
// negate org domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $org_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $org_domains
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
// sender profile
and (
not profile.by_sender_email().solicited
or not profile.by_sender_email().any_messages_benign
or (
profile.by_sender_email().any_messages_malicious_or_spam
and not profile.by_sender_email().any_messages_benign
)
or (
sender.email.domain.domain in $org_domains
and not coalesce(headers.auth_summary.dmarc.pass, false)
)
)
Detection logic
Scope: inbound message.
This rule identifies potential impersonation attempts involving the local part of an $org_vip email address. Specifically, it checks for cases where the local part of an $org_vip email (e.g., local_part@domain.com) appears with a different domain (e.g., local_part@foreigndomain.com). Additionally, the rule flags messages that match an $org_vip address exactly but fail authentication.
- inbound message
any of
$org_vipswhere all hold:- sender.email.local_part contains '.'
- strings.starts_with(.email)
any of:
- sender.email.email is not .email
all of:
- sender.email.email is .email
not:
- headers.auth_summary.dmarc.pass
any of:
- length(recipients.to) > 0
- length(recipients.cc) > 0
- sender.display_name is not mailbox.display_name
not:
sender.email.local_part matches any of 3 patterns
*postmaster**mailer-daemon**administrator*
any of:
all of:
- sender.email.domain.root_domain in $org_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $org_domains
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
any of:
not:
- profile.by_sender_email().solicited
not:
- profile.by_sender_email().any_messages_benign
all of:
- profile.by_sender_email().any_messages_malicious_or_spam
not:
- profile.by_sender_email().any_messages_benign
all of:
- sender.email.domain.domain in $org_domains
not:
- coalesce(headers.auth_summary.dmarc.pass)
Inspects: headers.auth_summary.dmarc.pass, mailbox.display_name, recipients.cc, recipients.to, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.email, sender.email.local_part, type.inbound. Sensors: profile.by_sender_email, strings.contains, strings.like, strings.starts_with. Reference lists: $high_trust_sender_root_domains, $org_domains, $org_vips.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
strings.contains | substring | . |
strings.like | substring | *postmaster* |
strings.like | substring | *mailer-daemon* |
strings.like | substring | *administrator* |