sublimehighRule

Brand impersonation: DigitalOcean

Impersonation of the cloud provider DigitalOcean.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003 T1583.001

initial-access

Detection Query

type.inbound
and (
  sender.display_name =~ 'digitalocean'
  or strings.ilevenshtein(sender.display_name, 'digitalocean') <= 2
  or strings.ilike(sender.email.domain.domain, '*digitalocean*')
)
and sender.email.domain.root_domain not in (
  'digitalocean.com',
  'paperspace.com',
  'coupahost.com' // third party supplier used by DigitalOcean 
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and not profile.by_sender().any_messages_benign

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Brand impersonation: DigitalOcean"
description: |
  Impersonation of the cloud provider DigitalOcean.
type: "rule"
severity: "high"
source: |
  type.inbound
  and (
    sender.display_name =~ 'digitalocean'
    or strings.ilevenshtein(sender.display_name, 'digitalocean') <= 2
    or strings.ilike(sender.email.domain.domain, '*digitalocean*')
  )
  and sender.email.domain.root_domain not in (
    'digitalocean.com',
    'paperspace.com',
    'coupahost.com' // third party supplier used by DigitalOcean 
  )
  and (
    not profile.by_sender().solicited
    or (
      profile.by_sender().any_messages_malicious_or_spam
      and not profile.by_sender().any_messages_benign
    )
  )
  and not profile.by_sender().any_messages_benign
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "Lookalike domain"
  - "Social engineering"
detection_methods:
  - "Header analysis"
  - "Sender analysis"
id: "7f2f0e97-b89f-54dd-9167-cbf1e55b112b"