Cyrillic vowel substitutions with suspicious subject from unknown sender
This rule detects unsolicited messages with between 1-9 links containing a suspicious subject as well as Cyrillic vowel substitutions detected in either the subject or the senders display name.
Sublime rule (View on GitHub)
1name: "Cyrillic vowel substitutions with suspicious subject from unknown sender"
2description: "This rule detects unsolicited messages with between 1-9 links containing a suspicious subject as well as Cyrillic vowel substitutions detected in either the subject or the senders display name."
3type: "rule"
4severity: "medium"
5source: |
6 type.inbound
7 and 0 < length(body.links) < 10
8
9 // display name or subject contains Cyrillic/Greek confusables alongside Latin
10 and any([subject.subject, sender.display_name],
11 (
12 regex.contains(.,
13 '[a-zA-Z][\x{430}\x{435}\x{438}\x{43e}\x{443}\x{440}\x{441}\x{445}\x{456}\x{410}\x{412}\x{415}\x{41a}\x{41c}\x{41d}\x{41e}\x{420}\x{421}\x{422}\x{425}\x{391}\x{392}\x{395}\x{396}\x{397}\x{399}\x{39a}\x{39c}\x{39d}\x{39f}\x{3a1}\x{3a4}\x{3a5}\x{3a7}\x{3bf}]|[\x{430}\x{435}\x{438}\x{43e}\x{443}\x{440}\x{441}\x{445}\x{456}\x{410}\x{412}\x{415}\x{41a}\x{41c}\x{41d}\x{41e}\x{420}\x{421}\x{422}\x{425}\x{391}\x{392}\x{395}\x{396}\x{397}\x{399}\x{39a}\x{39c}\x{39d}\x{39f}\x{3a1}\x{3a4}\x{3a5}\x{3a7}\x{3bf}][a-zA-Z]'
14 )
15 or regex.icontains(., '(а|е|и|о|у)') and regex.icontains(., '[a-z]')
16 )
17 )
18
19 // and suspicious subject
20 and regex.icontains(subject.subject,
21 // https://github.com/sublime-security/static-files/blob/main/suspicious_subjects_regex.txt
22 "termination.*notice",
23 "38417",
24 ":completed",
25 "[il1]{2}mit.*ma[il1]{2} ?bo?x",
26 "[il][il][il]egai[ -]",
27 "[li][li][li]ega[li] attempt",
28 "[ng]-?[io]n .*block",
29 "[ng]-?[io]n .*cancel",
30 "[ng]-?[io]n .*deactiv",
31 "[ng]-?[io]n .*disabl",
32 "action.*required",
33 "abandon.*package",
34 "about.your.account",
35 "acc(ou)?n?t (is )?on ho[li]d",
36 "acc(ou)?n?t.*terminat",
37 "acc(oun)?t.*[il1]{2}mitation",
38 "access.*limitation",
39 "account (will be )?block",
40 "account.*de-?activat",
41 "account.*locked",
42 "account.*re-verification",
43 "account.*security",
44 "account.*suspension",
45 "account.has.been",
46 "account.has.expired",
47 "account.will.be.blocked",
48 "account v[il]o[li]at",
49 "activity.*acc(oun)?t",
50 "almost.full",
51 "app[li]e.[il]d",
52 "authenticate.*account",
53 "been.*suspend",
54 "clos.*of.*account.*processed",
55 "confirm.your.account",
56 "courier.*able",
57 "crediential.*notif",
58 "deactivation.*in.*progress",
59 "delivery.*attempt.*failed",
60 "document.received",
61 "documented.*shared.*with.*you",
62 "dropbox.*document",
63 "e-?ma[il1]+ .{010}suspen",
64 "e-?ma[il1]{1} user",
65 "e-?ma[il1]{2} acc",
66 "e-?ma[il1]{2}.*up.?grade",
67 "e.?ma[il1]{2}.*server",
68 "e.?ma[il1]{2}.*suspend",
69 "email.update",
70 "faxed you",
71 "fraud(ulent)?.*charge",
72 "from.helpdesk",
73 "fu[il1]{2}.*ma[il1]+[ -]?box",
74 "has.been.*suspended",
75 "has.been.limited",
76 "have.locked",
77 "he[li]p ?desk upgrade",
78 "heipdesk",
79 "i[il]iega[il]",
80 "ii[il]ega[il]",
81 "incoming e?mail",
82 "incoming.*fax",
83 "lock.*security",
84 "ma[il1]{1}[ -]?box.*quo",
85 "ma[il1]{2}[ -]?box.*fu[il1]",
86 "ma[il1]{2}box.*[il1]{2}mit",
87 "ma[il1]{2}box stor",
88 "mail on.?hold",
89 "mail.*box.*migration",
90 "mail.*de-?activat",
91 "mail.update.required",
92 "mails.*pending",
93 "messages.*pending",
94 "missed.*shipping.*notification",
95 "missed.shipment.notification",
96 "must.update.your.account",
97 "new [sl][io]g?[nig][ -]?in from",
98 "new voice ?-?mail",
99 "notifications.*pending",
100 "office.*3.*6.*5.*suspend",
101 "office365",
102 "on google docs with you",
103 "online doc",
104 "password.*compromised",
105 "periodic maintenance",
106 "potential(ly)? unauthorized",
107 "refund not approved",
108 "revised.*policy",
109 "scam",
110 "scanned.?invoice",
111 "secured?.update",
112 "security breach",
113 "securlty",
114 "signed.*delivery",
115 "status of your .{314}? ?delivery",
116 "susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty",
117 "suspicious.*sign.*[io]n",
118 "suspicious.activit",
119 "temporar(il)?y deactivate",
120 "temporar[il1]{2}y disab[li]ed",
121 "temporarily.*lock",
122 "un-?usua[li].activity",
123 "unable.*deliver",
124 "unauthorized.*activit",
125 "unauthorized.device",
126 "unauthorized.sign.?in",
127 "unrecognized.*activit",
128 "unrecognized.sign.?in",
129 "unrecognized.*activit",
130 "undelivered message",
131 "unread.*doc",
132 "unusual.activity",
133 "upgrade.*account",
134 "upgrade.notice",
135 "urgent message",
136 "urgent.verification",
137 "v[il1]o[li1]at[il1]on security",
138 "va[il1]{1}date.*ma[il1]{2}[ -]?box",
139 "verification ?-?require",
140 "verification( )?-?need",
141 "verify.your?.account",
142 "web ?-?ma[il1]{2}",
143 "web[ -]?ma[il1]{2}",
144 "will.be.suspended",
145 "your (customer )?account .as",
146 "your.office.365",
147 "your.online.access",
148
149 // https://github.com/sublime-security/static-files/blob/main/suspicious_subjects.txt
150 "account has been limited",
151 "action required",
152 "almost full",
153 "apd notifi cation",
154 "are you at your desk",
155 "are you available",
156 "attached file to docusign",
157 "banking is temporarily unavailable",
158 "bankofamerica",
159 "closing statement invoice",
160 "completed: docusign",
161 "de-activation of",
162 "delivery attempt",
163 "delivery stopped for shipment",
164 "detected suspicious",
165 "detected suspicious actvity",
166 "docu sign",
167 "document for you",
168 "document has been sent to you via docusign",
169 "document is ready for signature",
170 "docusign",
171 "encrypted message",
172 "failed delivery",
173 "fedex tracking",
174 "file was shared",
175 "freefax",
176 "fwd: due invoice paid",
177 "has shared",
178 "inbox is full",
179 "invitation to comment",
180 "invitation to edit",
181 "invoice due",
182 "left you a message",
183 "message from",
184 "new message",
185 "new voicemail",
186 "on desk",
187 "out of space",
188 "password reset",
189 "payment status",
190 "quick reply",
191 "re: w-2",
192 "required",
193 "required: completed docusign",
194 "ringcentral",
195 "scanned image",
196 "secured files",
197 "secured pdf",
198 "security alert",
199 "new sign-in",
200 "new sign in",
201 "sign-in attempt",
202 "sign in attempt",
203 "staff review",
204 "suspicious activity",
205 "unrecognized login attempt",
206 "upgrade immediately",
207 "urgent",
208 "wants to share",
209 "w2",
210 "you have notifications pending",
211 "your account",
212 "your amazon order",
213 "your document settlement",
214 "your order with amazon",
215 "your password has been compromised",
216 )
217
218 // the message is unsolicited and no false positives
219 and (
220 not profile.by_sender().solicited
221 or (
222 length(headers.reply_to) > 0
223 and all(headers.reply_to, .email.email not in $recipient_emails)
224 )
225 )
226 and not profile.by_sender().any_messages_benign
227attack_types:
228 - "Credential Phishing"
229tactics_and_techniques:
230 - "Evasion"
231 - "Impersonation: Brand"
232 - "Social engineering"
233detection_methods:
234 - "Content analysis"
235 - "Sender analysis"
236id: "10251c3c-b926-5742-9417-4cf58d182230"