Detection rules › Sublime MQL
Service abuse: Meetup.com redirect with brand impersonation
Detects messages abusing Meetup.com's click tracking service with lengthy redirect URLs while impersonating legitimate Meetup communications. The rule identifies suspicious links to clicks.meetup.com with URLs exceeding 300 characters, excludes legitimate Meetup emails by checking for their branding elements, and filters out high-trust authenticated senders.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Open redirect, Impersonation: Brand, Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
// we check 'body links' as this campaign has been observed abusing fake threads
and any(body.links,
.href_url.domain.domain == "clicks.meetup.com"
// lengthy url hints at redirect the circus that occurs
and length(.href_url.url) > 300
)
// negate legit meetup.com by checking for their logo
and not any(html.xpath(body.html, '//img/@src').nodes,
strings.icontains(.raw, 'meetupstatic')
)
// negate high trust senders that pass auth
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Detection logic
Scope: inbound message.
Detects messages abusing Meetup.com's click tracking service with lengthy redirect URLs while impersonating legitimate Meetup communications. The rule identifies suspicious links to clicks.meetup.com with URLs exceeding 300 characters, excludes legitimate Meetup emails by checking for their branding elements, and filters out high-trust authenticated senders.
- inbound message
any of
body.linkswhere all hold:- .href_url.domain.domain is 'clicks.meetup.com'
- length(.href_url.url) > 300
not:
any of
html.xpath(body.html, '//img/@src').nodeswhere:- .raw contains 'meetupstatic'
not:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
- coalesce(headers.auth_summary.dmarc.pass)
Inspects: body.html, body.links, body.links[].href_url.domain.domain, body.links[].href_url.url, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: html.xpath, strings.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.domain | equals | clicks.meetup.com |
strings.icontains | substring | meetupstatic |