sublimehighRule

Brand impersonation: ConstructConnect

Detects links impersonating the ConstructConnect platform. The rule identifies suspicious links from non-legitimate domains that load ConstructConnect logo assets, suggesting the sender is spoofing the platform to appear legitimate.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003

initial-access

Detection Query

type.inbound
// self sender or invalid recipient domain
and length(recipients.to) == 1
and (
  sender.email.email == recipients.to[0].email.email
  or recipients.to[0].email.domain.valid == false
)
and 0 < length(body.current_thread.links) < 10
and any(body.current_thread.links,
        .href_url.domain.root_domain != 'constructconnect.com'
        and any(ml.link_analysis(., mode="aggressive").unique_urls_accessed,
                .domain.root_domain == 'constructconnect.com'
                and strings.icontains(.path, 'logo', 'favicon.ico')
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Brand impersonation: ConstructConnect"
description: "Detects links impersonating the ConstructConnect platform. The rule identifies suspicious links from non-legitimate domains that load ConstructConnect logo assets, suggesting the sender is spoofing the platform to appear legitimate."
type: "rule"
severity: "high"
source: |
  type.inbound
  // self sender or invalid recipient domain
  and length(recipients.to) == 1
  and (
    sender.email.email == recipients.to[0].email.email
    or recipients.to[0].email.domain.valid == false
  )
  and 0 < length(body.current_thread.links) < 10
  and any(body.current_thread.links,
          .href_url.domain.root_domain != 'constructconnect.com'
          and any(ml.link_analysis(., mode="aggressive").unique_urls_accessed,
                  .domain.root_domain == 'constructconnect.com'
                  and strings.icontains(.path, 'logo', 'favicon.ico')
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Spoofing"
  - "Social engineering"
detection_methods:
  - "Sender analysis"
  - "URL analysis"
id: "1a088f99-e9a9-5ec5-a64e-84399a5c1eb9"