June 2024 Summaries

Sublime's Attack Spotlight series highlights the evolving email threat landscape by presenting real-world attack samples, detailing adversary tactics and techniques, and explaining detection methods. The series focuses on Business Email Compromise (BEC) attacks targeting Microsoft 365 and Google Workspace users, specifically aiming to defraud organizations by soliciting payments for fraudulent invoices. These attacks are highly personalized, with PDF attachments mimicking legitimate company invoices and W-9 forms, often impersonating high-ranking individuals like CEOs to add credibility. The messages are crafted to appear as urgent with fake forwarded threads, and some sender domains are newly registered to enhance deception. Sublime employs advanced detection signals, including the use of Natural Language Understanding models, to identify and prevent such threats, offering deployment in an alert-only mode for organizations seeking to enhance their email security.

Sublime's Attack Score is a sophisticated AI-backed feature designed to evaluate potential email threats by combining the strengths of both black box AI models and rule-based systems. It leverages machine learning to analyze various signals within emails, such as headers, attachment metadata, and link analysis, to identify attack patterns and unusual activities. The system uses an interpretable XGBoost model to ensure transparency and explainability, providing users with clear verdicts and insights into the rationale behind each decision. This approach not only saves manual investigation time but also maintains data privacy by using privacy-preserving feature engineering that excludes personally identifiable information. The platform continuously updates its model with new data and signals to stay ahead of emerging threats, ensuring that security solutions remain effective and trustworthy while empowering analysts with actionable insights.