Detection rules › Sublime MQL

Service Abuse: Box file sharing with credential phishing intent

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects abuse of Box's legitimate infrastructure for credential phishing attacks.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, BEC/Fraud, Callback Phishing
Tactics and techniquesEvasion, Social engineering, Impersonation: Employee, Impersonation: VIP

Event coverage

Rule body MQL

type.inbound

// Legitimate Box sending infrastructure
and sender.email.domain.root_domain == "box.com"

// ML classification indicates credential theft with high confidence
and (
  any(ml.nlu_classifier(body.current_thread.text).intents,
      .name == "cred_theft" and .confidence == "high"
  )
  // Link analysis for credential phishing detection
  or any(filter(body.links,
                // target the box link
                (
                  .href_url.domain.domain == "app.box.com"
                )
         ),
         ml.link_analysis(., mode="aggressive").credphish.disposition == "phishing"
         and ml.link_analysis(., mode="aggressive").credphish.confidence in (
           "medium",
           "high"
         )
  )
)
// Box file sharing patterns
and (
  strings.icontains(subject.subject, 'invited you to')
  or strings.icontains(subject.subject, 'shared')
  or strings.icontains(subject.subject, 'has sent you')
  or strings.icontains(body.current_thread.text, 'Go to File')
  or any(body.links, strings.icontains(.display_text, 'Go to File'))
)

// Suspicious document patterns or VIP impersonation
and (
  // Financial document patterns
  (
    regex.icontains(subject.subject,
                    '\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\b'
    )
    or regex.icontains(body.current_thread.text,
                       '\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\b'
    )
    or any(body.links,
           regex.icontains(.display_text,
                           '\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\b'
           )
    )
  )
  // Corporate document patterns
  or (
    regex.icontains(subject.subject,
                    '\b(urgent|important|confidential|secure|encrypted|document|file)\b'
    )
    and regex.icontains(subject.subject,
                        '\b(review|approval|signature|verification|validation)\b'
    )
  )
)

Detection logic

Scope: inbound message.

Detects abuse of Box's legitimate infrastructure for credential phishing attacks.

  1. inbound message
  2. sender.email.domain.root_domain is 'box.com'
  3. any of:
    • any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
      • .name is 'cred_theft'
      • .confidence is 'high'
    • any of filter(body.links) where all hold:
      • ml.link_analysis(.).credphish.disposition is 'phishing'
      • ml.link_analysis(.).credphish.confidence in ('medium', 'high')
  4. any of:
    • subject.subject contains 'invited you to'
    • subject.subject contains 'shared'
    • subject.subject contains 'has sent you'
    • body.current_thread.text contains 'Go to File'
    • any of body.links where:
      • .display_text contains 'Go to File'
  5. any of:
    • any of:
      • subject.subject matches '\\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\\b'
      • body.current_thread.text matches '\\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\\b'
      • any of body.links where:
        • .display_text matches '\\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\\b'
    • all of:
      • subject.subject matches '\\b(urgent|important|confidential|secure|encrypted|document|file)\\b'
      • subject.subject matches '\\b(review|approval|signature|verification|validation)\\b'

Inspects: body.current_thread.text, body.links, body.links[].display_text, body.links[].href_url.domain.domain, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: ml.link_analysis, ml.nlu_classifier, regex.icontains, strings.icontains.

Indicators matched (11)

FieldMatchValue
sender.email.domain.root_domainequalsbox.com
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscred_theft
ml.nlu_classifier(body.current_thread.text).intents[].confidenceequalshigh
body.links[].href_url.domain.domainequalsapp.box.com
strings.icontainssubstringinvited you to
strings.icontainssubstringshared
strings.icontainssubstringhas sent you
strings.icontainssubstringGo to File
regex.icontainsregex\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\b
regex.icontainsregex\b(urgent|important|confidential|secure|encrypted|document|file)\b
regex.icontainsregex\b(review|approval|signature|verification|validation)\b