detection.wiki

Detection rules › Sublime MQL

Service abuse: Wix redirect through bulk mailer domains

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing Wix-encoded links that redirect through bulk mailing service domains, potentially bypassing security controls through legitimate redirect services.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesEvasion, Open redirect

Event coverage

Message attribute
body
body.links (collection)
type

Rule body MQL

type.inbound
and any(filter(body.links, 'wix' in .href_url.rewrite.encoders),
        .href_url.domain.root_domain in $bulk_mailer_url_root_domains
)

Detection logic

Scope: inbound message.

Detects messages containing Wix-encoded links that redirect through bulk mailing service domains, potentially bypassing security controls through legitimate redirect services.

  1. inbound message
  2. any of filter(body.links) where:
    • .href_url.domain.root_domain in $bulk_mailer_url_root_domains

Inspects: body.links, body.links[].href_url.rewrite.encoders, type.inbound. Reference lists: $bulk_mailer_url_root_domains.

Indicators matched (1)

FieldMatchValue
body.links[].href_url.rewrite.encoderscontainswix