Detection rules › Sublime MQL
Service Abuse: Zoom with freemail reply-to and recipient address in greeting
Detects messages impersonating Zoom that use a freemail provider for the reply-to address, have a new and unsolicited reply-to profile, and contain the recipient's email address in the greeting line where a name would normally appear.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
| Tactics and techniques | Free email provider, Social engineering |
Event coverage
Rule body MQL
type.inbound
// is from zoom
and sender.email.email == "no-reply@zoom.us"
// has a freemail for a reply-to address
and headers.reply_to[0].email.domain.domain in $free_email_providers
// the reply-to address is new
and beta.profile.by_reply_to().prevalence == "new"
and not beta.profile.by_reply_to().solicited
// the "greeting" line contains an email address matching the recipient's email root domain
// this is normally a name
and any(regex.iextract(body.current_thread.text,
'^\S+\s+(?P<last_word>\S+?),?(?:\n|\z)'
),
strings.parse_email(.named_groups["last_word"]).domain.root_domain == recipients.to[0].email.domain.root_domain
)
Detection logic
Scope: inbound message.
Detects messages impersonating Zoom that use a freemail provider for the reply-to address, have a new and unsolicited reply-to profile, and contain the recipient's email address in the greeting line where a name would normally appear.
- inbound message
- sender.email.email is 'no-reply@zoom.us'
- headers.reply_to[0].email.domain.domain in $free_email_providers
- beta.profile.by_reply_to().prevalence is 'new'
not:
- beta.profile.by_reply_to().solicited
any of
regex.iextract(body.current_thread.text)where:- strings.parse_email(.named_groups['last_word']).domain.root_domain is recipients.to[0].email.domain.root_domain
Inspects: body.current_thread.text, headers.reply_to[0].email.domain.domain, recipients.to[0].email.domain.root_domain, sender.email.email, type.inbound. Sensors: beta.profile.by_reply_to, regex.iextract, strings.parse_email. Reference lists: $free_email_providers.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
sender.email.email | equals | no-reply@zoom.us |
regex.iextract | regex | ^\S+\s+(?P<last_word>\S+?),?(?:\n|\z) |