sublimehighRule

Impersonation: SAM/SBA federal registration

Detects inbound messages impersonating SAM.gov or the Small Business Administration by matching sender display names against known spoofed naming patterns (e.g. sba-support, sam registration/renewal) or by identifying sam.gov references paired with an embedded 'renew entity' image lure. Legitimate senders from verified sba.gov, sam.gov, or other high-trust domains that pass DMARC authentication are excluded.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1534 T1656 T1598.003

initial-access

Detection Query

type.inbound
and (
  regex.icontains(sender.display_name,
                  '^sam(?:\.gov\b|\s(?:renew|compliance))',
                  'final\ssam\.gov',
                  '^sba[\s-]?(?:e[fd]|[\.,]gov)',
                  '^sba[\s-](?:connect|invoice|admin|eidl)\b',
                  '^sba[\s-]support[\s-]\w+'
  )
  or (
    strings.icontains(body.current_thread.text, 'sam.gov')
    and any(html.xpath(body.html, '//img/@src').nodes,
            strings.icontains(.raw, 'sam%20renew%20entity')
    )
  )
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Impersonation: SAM/SBA federal registration"
description: "Detects inbound messages impersonating SAM.gov or the Small Business Administration by matching sender display names against known spoofed naming patterns (e.g. sba-support, sam registration/renewal) or by identifying sam.gov references paired with an embedded 'renew entity' image lure. Legitimate senders from verified sba.gov, sam.gov, or other high-trust domains that pass DMARC authentication are excluded."
type: "rule"
severity: "high"
source: |
  type.inbound
  and (
    regex.icontains(sender.display_name,
                    '^sam(?:\.gov\b|\s(?:renew|compliance))',
                    'final\ssam\.gov',
                    '^sba[\s-]?(?:e[fd]|[\.,]gov)',
                    '^sba[\s-](?:connect|invoice|admin|eidl)\b',
                    '^sba[\s-]support[\s-]\w+'
    )
    or (
      strings.icontains(body.current_thread.text, 'sam.gov')
      and any(html.xpath(body.html, '//img/@src').nodes,
              strings.icontains(.raw, 'sam%20renew%20entity')
      )
    )
  )
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "Credential Phishing"
  - "BEC/Fraud"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
  - "Image as content"
detection_methods:
  - "Sender analysis"
  - "Content analysis"
  - "HTML analysis"
  - "Header analysis"
id: "057ad471-4564-584c-a700-bba6e0c6eea9"