sublimemediumRule

Brand impersonation: SiriusXM

Impersonation of the broadcasting corporation SiriusXM.

MITRE ATT&CK

T1566.003 T1598 T1566 T1566.001 T1566.002 T1598.003

initial-access

Detection Query

type.inbound
and (
  strings.ilike(sender.display_name, '*siriusxm*')
  or strings.ilevenshtein(sender.display_name, 'siriusxm') <= 1
  or strings.ilike(sender.email.domain.domain, '*siriusxm*')
)
and (
  sender.email.domain.root_domain not in (
    'siriusxm.com',
    'siriusxmmedia.com',
    'siriusxm.ca',
    'engagement360.net', // SiriusXM survey vendor
    'sciquest.com' // SiriusXM Procurement
  )
  or (
    sender.email.domain.root_domain in (
      'siriusxm.com',
      'siriusxmmedia.com',
      'siriusxm.ca',
      'engagement360.net', // SiriusXM survey vendor
      'sciquest.com' // SiriusXM Procurement
    )
    and not headers.auth_summary.dmarc.pass
  )
)
and not profile.by_sender().solicited

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Brand impersonation: SiriusXM"
description: "Impersonation of the broadcasting corporation SiriusXM."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    strings.ilike(sender.display_name, '*siriusxm*')
    or strings.ilevenshtein(sender.display_name, 'siriusxm') <= 1
    or strings.ilike(sender.email.domain.domain, '*siriusxm*')
  )
  and (
    sender.email.domain.root_domain not in (
      'siriusxm.com',
      'siriusxmmedia.com',
      'siriusxm.ca',
      'engagement360.net', // SiriusXM survey vendor
      'sciquest.com' // SiriusXM Procurement
    )
    or (
      sender.email.domain.root_domain in (
        'siriusxm.com',
        'siriusxmmedia.com',
        'siriusxm.ca',
        'engagement360.net', // SiriusXM survey vendor
        'sciquest.com' // SiriusXM Procurement
      )
      and not headers.auth_summary.dmarc.pass
    )
  )
  and not profile.by_sender().solicited
attack_types:
  - "Callback Phishing"
  - "Credential Phishing"
  - "Spam"
tactics_and_techniques:
  - "Free email provider"
  - "Impersonation: Brand"
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "Header analysis"
  - "Sender analysis"
id: "70eb3792-cd7a-5369-b1c3-65a3b772de00"