Detection rules › Sublime MQL
Service abuse: Vimeo with external plain-text links in message
Detects messages absuing Vimeo notifications about received messages that contain plain-text links redirecting to domains other than Vimeo, potentially leading users to malicious websites.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
and sender.email.domain.domain == 'vimeo.com'
and strings.ends_with(subject.base, 'sent you a message on Vimeo')
and (
// plain-text url that does not go to vimeo
any(filter(body.current_thread.links, .parser == "plain"),
.display_url.domain.root_domain != 'vimeo.com'
)
)
Detection logic
Scope: inbound message.
Detects messages absuing Vimeo notifications about received messages that contain plain-text links redirecting to domains other than Vimeo, potentially leading users to malicious websites.
- inbound message
- sender.email.domain.domain is 'vimeo.com'
- subject.base ends with 'sent you a message on Vimeo'
any of
filter(body.current_thread.links)where:- .display_url.domain.root_domain is not 'vimeo.com'
Inspects: body.current_thread.links, body.current_thread.links[].parser, sender.email.domain.domain, subject.base, type.inbound. Sensors: strings.ends_with.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
sender.email.domain.domain | equals | vimeo.com |
strings.ends_with | suffix | sent you a message on Vimeo |
body.current_thread.links[].parser | equals | plain |