detection.wiki

Detection rules › Sublime MQL

Xero invoice abuse

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects suspicious Xero invoice communications containing urgent payment requests where the sender's display name contains either confusable characters or impersonates internal services like HR or IT support.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesImpersonation: Brand, Impersonation: Employee, Social engineering

Event coverage

Message attribute
body
body.current_thread
body.links (collection)
sender
sender.email
type

Rule body MQL

type.inbound
and sender.email.domain.root_domain == "xero.com"
and (
  // contains legitimate xero invoice links
  any(body.links,
      .href_url.domain.domain == "in.xero.com"
      or (
        .href_url.domain.root_domain == "mimecastprotect.com"
        and .href_url.query_params == "domain=in.xero.com"
      )
  )
  // or financial communications with invoice content and urgency
  and (
    any(beta.ml_topic(body.current_thread.text).topics,
        .name == "Financial Communications" and .confidence != "low"
    )
    and any(ml.nlu_classifier(body.current_thread.text).tags,
            .name == "invoice" and .confidence in ("medium", "high")
    )
    and any(ml.nlu_classifier(body.current_thread.text).entities,
            .name == "urgency"
    )
    and any(ml.nlu_classifier(body.current_thread.text).entities,
            .name == "request"
    )
  )
)
and (
  // display name contains confusables (brand impersonation)
  sender.display_name != strings.replace_confusables(sender.display_name)
  // or HR/recruitment/employment/internal service impersonation
  or regex.icontains(sender.display_name,
                     '\bhr\b|human resources|staffing|recruiting|recruitment|employment|payroll|it support|help ?desk|admin|administrator'
  )
)

Detection logic

Scope: inbound message.

Detects suspicious Xero invoice communications containing urgent payment requests where the sender's display name contains either confusable characters or impersonates internal services like HR or IT support.

  1. inbound message
  2. sender.email.domain.root_domain is 'xero.com'
  3. all of:
    • any of body.links where any holds:
      • .href_url.domain.domain is 'in.xero.com'
      • all of:
        • .href_url.domain.root_domain is 'mimecastprotect.com'
        • .href_url.query_params is 'domain=in.xero.com'
    • all of:
      • any of beta.ml_topic(body.current_thread.text).topics where all hold:
        • .name is 'Financial Communications'
        • .confidence is not 'low'
      • any of ml.nlu_classifier(body.current_thread.text).tags where all hold:
        • .name is 'invoice'
        • .confidence in ('medium', 'high')
      • any of ml.nlu_classifier(body.current_thread.text).entities where:
        • .name is 'urgency'
      • any of ml.nlu_classifier(body.current_thread.text).entities where:
        • .name is 'request'
  4. any of:
    • sender.display_name is not strings.replace_confusables(sender.display_name)
    • sender.display_name matches '\\bhr\\b|human resources|staffing|recruiting|recruitment|employment|payroll|it support|help ?desk|admin|administrator'

Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.query_params, sender.display_name, sender.email.domain.root_domain, type.inbound. Sensors: beta.ml_topic, ml.nlu_classifier, regex.icontains, strings.replace_confusables.

Indicators matched (11)

FieldMatchValue
sender.email.domain.root_domainequalsxero.com
body.links[].href_url.domain.domainequalsin.xero.com
body.links[].href_url.domain.root_domainequalsmimecastprotect.com
body.links[].href_url.query_paramsequalsdomain=in.xero.com
beta.ml_topic(body.current_thread.text).topics[].nameequalsFinancial Communications
ml.nlu_classifier(body.current_thread.text).tags[].nameequalsinvoice
ml.nlu_classifier(body.current_thread.text).tags[].confidencemembermedium
ml.nlu_classifier(body.current_thread.text).tags[].confidencememberhigh
ml.nlu_classifier(body.current_thread.text).entities[].nameequalsurgency
ml.nlu_classifier(body.current_thread.text).entities[].nameequalsrequest
regex.icontainsregex\bhr\b|human resources|staffing|recruiting|recruitment|employment|payroll|it support|help ?desk|admin|administrator