sublimemediumRule

Service abuse: Task management message sent via SendGrid

Detects messages impersonating task or productivity applications by using 'todo list' in the subject line or body while utilizing SendGrid infrastructure. The sender claims to be task-related through display name or body content but originates from non-legitimate domains without proper DMARC authentication.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
// subject contains "todo list"
and (
  regex.icontains(subject.subject, "T[0o][-\\s]*D[o0][-\\s]*L[I1l]ST")
  // or we can check the body for todo list content with high cred_theft intent
  or (
    regex.icontains(body.current_thread.text,
                    "T[0o][-\\s]*D[o0][-\\s]*L[I1l]ST"
    )
    and any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == "cred_theft" and .confidence == "high"
    )
  )
)
// utilizing sendgrid infra
and headers.return_path.domain.domain == "sendgrid.net"
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Service abuse: Task management message sent via SendGrid"
description: "Detects messages impersonating task or productivity applications by using 'todo list' in the subject line or body while utilizing SendGrid infrastructure. The sender claims to be task-related through display name or body content but originates from non-legitimate domains without proper DMARC authentication."
type: "rule"
severity: "medium"
source: |
  type.inbound
  // subject contains "todo list"
  and (
    regex.icontains(subject.subject, "T[0o][-\\s]*D[o0][-\\s]*L[I1l]ST")
    // or we can check the body for todo list content with high cred_theft intent
    or (
      regex.icontains(body.current_thread.text,
                      "T[0o][-\\s]*D[o0][-\\s]*L[I1l]ST"
      )
      and any(ml.nlu_classifier(body.current_thread.text).intents,
              .name == "cred_theft" and .confidence == "high"
      )
    )
  )
  // utilizing sendgrid infra
  and headers.return_path.domain.domain == "sendgrid.net"
  // negate highly trusted sender domains unless they fail DMARC authentication
  and (
    (
      sender.email.domain.root_domain in $high_trust_sender_root_domains
      and not headers.auth_summary.dmarc.pass
    )
    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
  )
  and (
    not profile.by_sender().solicited
    or (
      profile.by_sender().any_messages_malicious_or_spam
      and not profile.by_sender().any_messages_benign
    )
  )

attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Social engineering"
  - "Evasion"
detection_methods:
  - "Content analysis"
  - "Header analysis"
  - "Sender analysis"
id: "568a63f5-dbd2-5f9a-a84a-b4d8aa49c59b"