Brand impersonation: Sublime Security

 1name: "Brand impersonation: Sublime Security"
 2description: |
 3    Possible attempt to impersonate Sublime Security executives.
 4references:
 5  - "https://sandbox.sublimesecurity.com?id=612ff73b-e22d-4176-9e22-2b841b60a237"
 6type: "rule"
 7severity: "high"
 8source: |
 9  type.inbound
10  and (
11    sender.display_name in~ (
12      'Sublime Security',
13      'Josh Kamdjou',
14      'Joshua Kamdjou',
15      'Ian Thiel'
16    )
17    or strings.ilevenshtein(sender.email.domain.domain, 'sublimesecurity.com') <= 2
18  )
19  and sender.email.domain.root_domain not in (
20    'sublimesecurity.com',
21    'luma-mail.com',
22    'modernloop.io'
23  )
24  and (
25    profile.by_sender().prevalence in ("new", "outlier")
26    or (
27      profile.by_sender().any_messages_malicious_or_spam
28      and not profile.by_sender().any_messages_benign
29    )
30  )
31  
32  // negate highly trusted sender domains unless they fail DMARC authentication
33  and (
34    (
35      sender.email.domain.root_domain in $high_trust_sender_root_domains
36      and not headers.auth_summary.dmarc.pass
37    )
38    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
39  )  
40attack_types:
41  - "Credential Phishing"
42tactics_and_techniques:
43  - "Impersonation: Brand"
44  - "Lookalike domain"
45  - "Social engineering"
46detection_methods:
47  - "Sender analysis"
48id: "949484ed-c774-5f53-b91f-cd02ee6104f9"