Detection rules › Sublime MQL
Attachment: Dropbox image lure with no Dropbox domains in links
Detects Dropbox phishing emails with no Dropbox links with image attachments from an untrusted sender.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and length(filter(attachments, .file_type not in $file_types_images)) == 0
and any(body.links,
not strings.ilike(.href_url.domain.root_domain, "dropbox.*")
)
and any(attachments,
.file_type in $file_types_images
and any(file.explode(.),
strings.ilike(.scan.ocr.raw, "*dropbox*")
and strings.ilike(.scan.ocr.raw, "*review*", "*sign*")
)
)
and (
not profile.by_sender().solicited
or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
Detects Dropbox phishing emails with no Dropbox links with image attachments from an untrusted sender.
- inbound message
- length(filter(attachments, .file_type not in $file_types_images)) is 0
any of
body.linkswhere:not:
- .href_url.domain.root_domain matches 'dropbox.*'
any of
attachmentswhere all hold:- .file_type in $file_types_images
any of
file.explode(.)where all hold:- .scan.ocr.raw matches '*dropbox*'
.scan.ocr.raw matches any of 2 patterns
*review**sign*
any of:
not:
- profile.by_sender().solicited
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
Inspects: attachments[].file_type, body.links, body.links[].href_url.domain.root_domain, type.inbound. Sensors: file.explode, profile.by_sender, strings.ilike. Reference lists: $file_types_images.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | dropbox.* |
strings.ilike | substring | *dropbox* |
strings.ilike | substring | *review* |
strings.ilike | substring | *sign* |