detection.wiki

Detection rules › Sublime MQL

Service abuse: Suspicious Zoom Docs link

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages from Zoom Docs in which the document originates from a newly observed email address or contains suspicious indicators.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesSocial engineering, Free file host, Evasion

Event coverage

Message attribute
body
body.links (collection)
sender
sender.email
type

Rule body MQL

type.inbound
and sender.email.domain.root_domain == "zoom.us"
and strings.ends_with(sender.display_name, "Zoom Docs")
and (
  any(html.xpath(body.html, '//h2').nodes,
      // extract the sender email out of the message body
      any(regex.iextract(.display_text,
                         '^(?P<sender_display_name>[^\(]+)\((?P<sender_email>[^\)]+@(?P<sender_domain>[^\)]+))\)'
          ),
          .named_groups["sender_domain"] not in $org_domains
          and .named_groups["sender_email"] not in $recipient_emails
          and .named_groups["sender_email"] not in $sender_emails
          and not (
            .named_groups["sender_domain"] not in $free_email_providers
            and .named_groups["sender_domain"] in $recipient_domains
            and .named_groups["sender_domain"] in $sender_domains
          )
      )
  )
  or any(body.links,
         .href_url.domain.domain == "docs.zoom.us"
         and any(filter(ml.link_analysis(., mode="aggressive").final_dom.links,
                        .href_url.domain.root_domain != 'zoom.us'
                        and .href_url.domain.domain != 'zoom.us'
                 ),
                 (
                   // any of those links domains are new
                   network.whois(.href_url.domain).days_old < 30
                   // go to free file hosts
                   or .href_url.domain.root_domain in $free_file_hosts
                   or .href_url.domain.domain in $free_file_hosts

                   // go to free subdomains hosts
                   or (
                     .href_url.domain.root_domain in $free_subdomain_hosts
                     // where there is a subdomain
                     and .href_url.domain.subdomain is not null
                     and .href_url.domain.subdomain != "www"
                   )
                   // go to url shortners
                   or .href_url.domain.root_domain in $url_shorteners
                   or .href_url.domain.domain in $url_shorteners
                   or (
                     // find any links that mention common "action" words
                     regex.icontains(.display_text,
                                     '(?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account)'
                     )
                   )
                 )
         )
  )
)

Detection logic

Scope: inbound message.

Detects messages from Zoom Docs in which the document originates from a newly observed email address or contains suspicious indicators.

  1. inbound message
  2. sender.email.domain.root_domain is 'zoom.us'
  3. sender.display_name ends with 'Zoom Docs'
  4. any of:
    • any of html.xpath(body.html, '//h2').nodes where:
      • any of regex.iextract(.display_text) where all hold:
        • .named_groups['sender_domain'] not in $org_domains
        • .named_groups['sender_email'] not in $recipient_emails
        • .named_groups['sender_email'] not in $sender_emails
        • not:
          • all of:
            • .named_groups['sender_domain'] not in $free_email_providers
            • .named_groups['sender_domain'] in $recipient_domains
            • .named_groups['sender_domain'] in $sender_domains
    • any of body.links where all hold:
      • .href_url.domain.domain is 'docs.zoom.us'
      • any of filter(...) where any holds:
        • network.whois(.href_url.domain).days_old < 30
        • .href_url.domain.root_domain in $free_file_hosts
        • .href_url.domain.domain in $free_file_hosts
        • all of:
          • .href_url.domain.root_domain in $free_subdomain_hosts
          • .href_url.domain.subdomain is set
          • .href_url.domain.subdomain is not 'www'
        • .href_url.domain.root_domain in $url_shorteners
        • .href_url.domain.domain in $url_shorteners
        • .display_text matches '(?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account)'

Inspects: body.html, body.links, body.links[].href_url.domain.domain, sender.display_name, sender.email.domain.root_domain, type.inbound. Sensors: html.xpath, ml.link_analysis, network.whois, regex.icontains, regex.iextract, strings.ends_with. Reference lists: $free_email_providers, $free_file_hosts, $free_subdomain_hosts, $org_domains, $recipient_domains, $recipient_emails, $sender_domains, $sender_emails, $url_shorteners.

Indicators matched (5)

FieldMatchValue
sender.email.domain.root_domainequalszoom.us
strings.ends_withsuffixZoom Docs
regex.iextractregex^(?P<sender_display_name>[^\(]+)\((?P<sender_email>[^\)]+@(?P<sender_domain>[^\)]+))\)
body.links[].href_url.domain.domainequalsdocs.zoom.us
regex.icontainsregex(?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account)