Detection rules › Sublime MQL

Service abuse: Meetup.com redirect with brand impersonation

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages abusing Meetup.com's click tracking service with lengthy redirect URLs while impersonating legitimate Meetup communications. The rule identifies suspicious links to clicks.meetup.com with URLs exceeding 300 characters, excludes legitimate Meetup emails by checking for their branding elements, and filters out high-trust authenticated senders.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesOpen redirect, Impersonation: Brand, Evasion

Event coverage

Rule body MQL

type.inbound
// we check 'body links' as this campaign has been observed abusing fake threads
and any(body.links,
        .href_url.domain.domain == "clicks.meetup.com"
        // lengthy url hints at redirect the circus that occurs
        and length(.href_url.url) > 300
)
// negate legit meetup.com by checking for their logo
and not any(html.xpath(body.html, '//img/@src').nodes,
            strings.icontains(.raw, 'meetupstatic')
)
// negate high trust senders that pass auth
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Detection logic

Scope: inbound message.

Detects messages abusing Meetup.com's click tracking service with lengthy redirect URLs while impersonating legitimate Meetup communications. The rule identifies suspicious links to clicks.meetup.com with URLs exceeding 300 characters, excludes legitimate Meetup emails by checking for their branding elements, and filters out high-trust authenticated senders.

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.domain.domain is 'clicks.meetup.com'
    • length(.href_url.url) > 300
  3. not:
    • any of html.xpath(body.html, '//img/@src').nodes where:
      • .raw contains 'meetupstatic'
  4. not:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • coalesce(headers.auth_summary.dmarc.pass)

Inspects: body.html, body.links, body.links[].href_url.domain.domain, body.links[].href_url.url, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: html.xpath, strings.icontains. Reference lists: $high_trust_sender_root_domains.

Indicators matched (2)

FieldMatchValue
body.links[].href_url.domain.domainequalsclicks.meetup.com
strings.icontainssubstringmeetupstatic