Detection rules › Sublime MQL

Service abuse: Vimeo with external plain-text links in message

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages absuing Vimeo notifications about received messages that contain plain-text links redirecting to domains other than Vimeo, potentially leading users to malicious websites.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Rule body MQL

type.inbound
and sender.email.domain.domain == 'vimeo.com'
and strings.ends_with(subject.base, 'sent you a message on Vimeo')
and (
  // plain-text url that does not go to vimeo
  any(filter(body.current_thread.links, .parser == "plain"),
      .display_url.domain.root_domain != 'vimeo.com'
  )
)

Detection logic

Scope: inbound message.

Detects messages absuing Vimeo notifications about received messages that contain plain-text links redirecting to domains other than Vimeo, potentially leading users to malicious websites.

  1. inbound message
  2. sender.email.domain.domain is 'vimeo.com'
  3. subject.base ends with 'sent you a message on Vimeo'
  4. any of filter(body.current_thread.links) where:
    • .display_url.domain.root_domain is not 'vimeo.com'

Inspects: body.current_thread.links, body.current_thread.links[].parser, sender.email.domain.domain, subject.base, type.inbound. Sensors: strings.ends_with.

Indicators matched (3)

FieldMatchValue
sender.email.domain.domainequalsvimeo.com
strings.ends_withsuffixsent you a message on Vimeo
body.current_thread.links[].parserequalsplain