sublimehighRule

Service Abuse: ExactTarget with suspicious sender indicators

Message originates from ExactTarget infrastructure but uses a suspicious sender domain, including overly long salesforce.com domains, awsapps.com domains, domains containing UTF-8 encoding characters, or a suspicious sender display name.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1534 T1656 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and any(headers.domains, .root_domain == 'exacttarget.com')
and (
  (
    length(sender.email.email) >= 50
    and sender.email.domain.root_domain == "salesforce.com"
  )
  or sender.email.domain.root_domain == "awsapps.com"
  or strings.icontains(sender.email.domain.domain, '?utf-8')
  or regex.icontains(sender.display_name,
                     '.*\|.*(Manager|Careers|Recruitment|Specialist|Global)'
  )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Service Abuse: ExactTarget with suspicious sender indicators"
description: "Message originates from ExactTarget infrastructure but uses a suspicious sender domain, including overly long salesforce.com domains, awsapps.com domains, domains containing UTF-8 encoding characters, or a suspicious sender display name."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(headers.domains, .root_domain == 'exacttarget.com')
  and (
    (
      length(sender.email.email) >= 50
      and sender.email.domain.root_domain == "salesforce.com"
    )
    or sender.email.domain.root_domain == "awsapps.com"
    or strings.icontains(sender.email.domain.domain, '?utf-8')
    or regex.icontains(sender.display_name,
                       '.*\|.*(Manager|Careers|Recruitment|Specialist|Global)'
    )
  )

attack_types:
  - "Credential Phishing"
  - "BEC/Fraud"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "Header analysis"
  - "Sender analysis"
id: "6154f197-9543-50d8-af3d-f8a7e1d79cf8"