Brand impersonation: Sublime Security

calendar Apr 23, 2024  ยท
Share on: linkedin copy

Possible attempt to impersonate Sublime Security executives.

Sublime rule (View on GitHub)

 1name: "Brand impersonation: Sublime Security"
 2description: |
 3    Possible attempt to impersonate Sublime Security executives.
 4references:
 5  - "https://sandbox.sublimesecurity.com?id=612ff73b-e22d-4176-9e22-2b841b60a237"
 6type: "rule"
 7severity: "high"
 8source: |
 9  type.inbound
10  and (
11    sender.display_name in~ ('Sublime Security', 'Josh Kamdjou', 'Joshua Kamdjou', 'Ian Thiel')
12    or strings.ilevenshtein(sender.email.domain.domain, 'sublimesecurity.com') <= 2
13  )
14  and sender.email.domain.domain != 'sublimesecurity.com'
15  and (
16    profile.by_sender().prevalence in ("new", "outlier")
17    or (
18      profile.by_sender().any_messages_malicious_or_spam
19      and not profile.by_sender().any_false_positives
20    )
21  )
22
23  // negate highly trusted sender domains unless they fail DMARC authentication
24  and (
25    (
26      sender.email.domain.root_domain in $high_trust_sender_root_domains
27      and not headers.auth_summary.dmarc.pass
28    )
29    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
30  )  
31attack_types:
32  - "Credential Phishing"
33tactics_and_techniques:
34  - "Impersonation: Brand"
35  - "Lookalike domain"
36  - "Social engineering"
37detection_methods:
38  - "Sender analysis"
39id: "949484ed-c774-5f53-b91f-cd02ee6104f9"
to-top