detection.wiki

Detection rules › Sublime MQL

Abuse: Robinhood injected content

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages from Robinhood with injected HTML into one of the list fields, often the 'Device' field.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Message attribute
body
sender.email
type

Rule body MQL

type.inbound
and sender.email.email == "noreply@robinhood.com"
and any(html.xpath(body.html, '//div/ul[count(li) = 4]/li').nodes,
        length(.raw) > 500 and strings.count(.raw, "</") > 10
)

Detection logic

Scope: inbound message.

Detects messages from Robinhood with injected HTML into one of the list fields, often the 'Device' field.

  1. inbound message
  2. sender.email.email is 'noreply@robinhood.com'
  3. any of html.xpath(body.html, '//div/ul[count(li) = 4]/li').nodes where all hold:
    • length(.raw) > 500
    • strings.count(.raw, '</') > 10

Inspects: body.html, sender.email.email, type.inbound. Sensors: html.xpath, strings.count.

Indicators matched (1)

FieldMatchValue
sender.email.emailequalsnoreply@robinhood.com