Detection rules › Sublime MQL
Service Abuse: Box file sharing with credential phishing intent
Detects abuse of Box's legitimate infrastructure for credential phishing attacks.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, BEC/Fraud, Callback Phishing |
| Tactics and techniques | Evasion, Social engineering, Impersonation: Employee, Impersonation: VIP |
Event coverage
Rule body MQL
type.inbound
// Legitimate Box sending infrastructure
and sender.email.domain.root_domain == "box.com"
// ML classification indicates credential theft with high confidence
and (
any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "cred_theft" and .confidence == "high"
)
// Link analysis for credential phishing detection
or any(filter(body.links,
// target the box link
(
.href_url.domain.domain == "app.box.com"
)
),
ml.link_analysis(., mode="aggressive").credphish.disposition == "phishing"
and ml.link_analysis(., mode="aggressive").credphish.confidence in (
"medium",
"high"
)
)
)
// Box file sharing patterns
and (
strings.icontains(subject.subject, 'invited you to')
or strings.icontains(subject.subject, 'shared')
or strings.icontains(subject.subject, 'has sent you')
or strings.icontains(body.current_thread.text, 'Go to File')
or any(body.links, strings.icontains(.display_text, 'Go to File'))
)
// Suspicious document patterns or VIP impersonation
and (
// Financial document patterns
(
regex.icontains(subject.subject,
'\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\b'
)
or regex.icontains(body.current_thread.text,
'\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\b'
)
or any(body.links,
regex.icontains(.display_text,
'\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\b'
)
)
)
// Corporate document patterns
or (
regex.icontains(subject.subject,
'\b(urgent|important|confidential|secure|encrypted|document|file)\b'
)
and regex.icontains(subject.subject,
'\b(review|approval|signature|verification|validation)\b'
)
)
)
Detection logic
Scope: inbound message.
Detects abuse of Box's legitimate infrastructure for credential phishing attacks.
- inbound message
- sender.email.domain.root_domain is 'box.com'
any of:
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'cred_theft'
- .confidence is 'high'
any of
filter(body.links)where all hold:- ml.link_analysis(.).credphish.disposition is 'phishing'
- ml.link_analysis(.).credphish.confidence in ('medium', 'high')
any of:
- subject.subject contains 'invited you to'
- subject.subject contains 'shared'
- subject.subject contains 'has sent you'
- body.current_thread.text contains 'Go to File'
any of
body.linkswhere:- .display_text contains 'Go to File'
any of:
any of:
- subject.subject matches '\\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\\b'
- body.current_thread.text matches '\\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\\b'
any of
body.linkswhere:- .display_text matches '\\b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\\b'
all of:
- subject.subject matches '\\b(urgent|important|confidential|secure|encrypted|document|file)\\b'
- subject.subject matches '\\b(review|approval|signature|verification|validation)\\b'
Inspects: body.current_thread.text, body.links, body.links[].display_text, body.links[].href_url.domain.domain, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: ml.link_analysis, ml.nlu_classifier, regex.icontains, strings.icontains.
Indicators matched (11)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | equals | box.com |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | cred_theft |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | equals | high |
body.links[].href_url.domain.domain | equals | app.box.com |
strings.icontains | substring | invited you to |
strings.icontains | substring | shared |
strings.icontains | substring | has sent you |
strings.icontains | substring | Go to File |
regex.icontains | regex | \b(fund|portfolio|agreement|contract|proposal|invoice|payment|wire|settlement|billing|timesheet|hr)\b |
regex.icontains | regex | \b(urgent|important|confidential|secure|encrypted|document|file)\b |
regex.icontains | regex | \b(review|approval|signature|verification|validation)\b |