sublimehighRule

Generic service abuse from newly registered domain

Detects messages from services that write the true sender to the reply-to field, where the sender has no prior legitimate message history and is newly registered. Indicative of service abuse.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566.003 T1598 T1566 T1566.001 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and any(headers.reply_to, network.whois(.email.domain).days_old < 30)
and sender.email.domain.domain in $replyto_service_domains
// 
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
// 
and not beta.profile.by_reply_to().solicited
and not beta.profile.by_reply_to().any_messages_benign

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Tags

Attack surface reduction

Raw Content

name: "Generic service abuse from newly registered domain"
description: "Detects messages from services that write the true sender to the reply-to field, where the sender has no prior legitimate message history and is newly registered. Indicative of service abuse."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(headers.reply_to, network.whois(.email.domain).days_old < 30)
  and sender.email.domain.domain in $replyto_service_domains
  // 
  // This rule makes use of a beta feature and is subject to change without notice
  // using the beta feature in custom rules is not suggested until it has been formally released
  // 
  and not beta.profile.by_reply_to().solicited
  and not beta.profile.by_reply_to().any_messages_benign

tags:
  - "Attack surface reduction"
attack_types:
  - "BEC/Fraud"
  - "Callback Phishing"
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "Header analysis"
  - "Sender analysis"
  - "Whois"
id: "0937b4c5-72d8-5efd-834f-c80ca8336f25"