detection.wiki

Detection rules › Sublime MQL

Attachment: EML with link to credential phishing page

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Attached EML links to a credential phishing site or exhibits unusual behavior such as multiple suspicious redirects.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Free file host, Free subdomain host, Social engineering

Event coverage

Message attribute
attachments (collection)
body.current_thread
body.html
headers (collection)
headers.reply_to (collection)
recipients
recipients.to (collection)
sender
sender.email
subject
type

Rule body MQL

type.inbound
and length(attachments) == 1
and any(attachments,
        (.content_type == "message/rfc822" or .file_extension =~ "eml")

        // identifies suspicious URLs in the attached EML
        and any(file.parse_eml(.).body.links,
                (
                  ml.link_analysis(., mode="aggressive").credphish.disposition == "phishing"
                  and ml.link_analysis(., mode="aggressive").credphish.confidence in (
                    "medium",
                    "high"
                  )
                )

                // or any links in the final dom lead to a suspicious tld
                or any(ml.link_analysis(.).final_dom.links,
                       .href_url.domain.tld in $suspicious_tlds
                       or ml.link_analysis(.href_url).effective_url.domain.tld in $suspicious_tlds
                )

                // link redirects to a suspicious TLD
                or any(ml.link_analysis(., mode="aggressive").redirect_history,
                       .domain.tld in $suspicious_tlds
                )
                or (
                  // suspicious redirects
                  // 3 or more different domains with 2 or more different TLDs
                  // careful because click trackers will always make this at least 2
                  // different domains and not unlikely 2 or more TLDs
                  length(distinct(map(ml.link_analysis(., mode="aggressive").redirect_history,
                                      .domain.tld
                                  )
                         )
                  ) >= 2
                  and length(distinct(map(ml.link_analysis(., mode="aggressive").redirect_history,
                                          .domain.domain
                                      )
                             )
                  ) >= 3
                )
        )

        // identifies other suspicious indicators
        and (
          // engaging language in the original body
          any(ml.nlu_classifier(body.current_thread.text).entities,
              .name == "request"
          )

          // // engaging language in the attached EML
          or any(ml.nlu_classifier(file.parse_eml(.).body.current_thread.text).entities,
                 .name == "request"
          )
          // recipient SLD impersonated in the subject or display name
          or any(recipients.to,
                 // ensure that we're checking the org SLD
                 .email.domain.sld in $org_slds
                 and (
                   strings.icontains(subject.subject, .email.domain.sld)
                   or strings.icontains(sender.display_name, .email.domain.sld)
                 )
          )
          // mismatched sender (From) and Reply-to + freemail
          or any(headers.reply_to,
                 length(headers.reply_to) > 0
                 and all(headers.reply_to,
                         .email.domain.root_domain != sender.email.domain.root_domain
                         and .email.domain.root_domain in $free_email_providers
                 )
          )
          or any($suspicious_subjects, strings.icontains(subject.subject, .))
          or regex.icontains(subject.subject,
                             "termination.*notice",
                             "38417",
                             ":completed",
                             "[il1]{2}mit.*ma[il1]{2} ?bo?x",
                             "[il][il][il]egai[ -]",
                             "[li][li][li]ega[li] attempt",
                             "[ng]-?[io]n .*block",
                             "[ng]-?[io]n .*cancel",
                             "[ng]-?[io]n .*deactiv",
                             "[ng]-?[io]n .*disabl",
                             "action.*required",
                             "abandon.*package",
                             "about.your.account",
                             "acc(ou)?n?t (is )?on ho[li]d",
                             "acc(ou)?n?t.*terminat",
                             "acc(oun)?t.*[il1]{2}mitation",
                             "access.*limitation",
                             "account (will be )?block",
                             "account.*de-?activat",
                             "account.*locked",
                             "account.*re-verification",
                             "account.*security",
                             "account.*suspension",
                             "account.has.been",
                             "account.has.expired",
                             "account.will.be.blocked",
                             "account v[il]o[li]at",
                             "activity.*acc(oun)?t",
                             "almost.full",
                             "app[li]e.[il]d",
                             "authenticate.*account",
                             "been.*suspend",
                             "clos.*of.*account.*processed",
                             "confirm.your.account",
                             "courier.*able",
                             "crediential.*notif",
                             "deactivation.*in.*progress",
                             "delivery.*attempt.*failed",
                             "document.received",
                             "documented.*shared.*with.*you",
                             "dropbox.*document",
                             "e-?ma[il1]+ .{010}suspen",
                             "e-?ma[il1]{1} user",
                             "e-?ma[il1]{2} acc",
                             "e-?ma[il1]{2}.*up.?grade",
                             "e.?ma[il1]{2}.*server",
                             "e.?ma[il1]{2}.*suspend",
                             "email.update",
                             "faxed you",
                             "fraud(ulent)?.*charge",
                             "from.helpdesk",
                             "fu[il1]{2}.*ma[il1]+[ -]?box",
                             "has.been.*suspended",
                             "has.been.limited",
                             "have.locked",
                             "he[li]p ?desk upgrade",
                             "heipdesk",
                             "i[il]iega[il]",
                             "ii[il]ega[il]",
                             "incoming e?mail",
                             "incoming.*fax",
                             "lock.*security",
                             "ma[il1]{1}[ -]?box.*quo",
                             "ma[il1]{2}[ -]?box.*fu[il1]",
                             "ma[il1]{2}box.*[il1]{2}mit",
                             "ma[il1]{2}box stor",
                             "mail on.?hold",
                             "mail.*box.*migration",
                             "mail.*de-?activat",
                             "mail.update.required",
                             "mails.*pending",
                             "messages.*pending",
                             "missed.*shipping.*notification",
                             "missed.shipment.notification",
                             "must.update.your.account",
                             "new [sl][io]g?[nig][ -]?in from",
                             "new voice ?-?mail",
                             "notifications.*pending",
                             "office.*3.*6.*5.*suspend",
                             "office365",
                             "on google docs with you",
                             "online doc",
                             "password.*compromised",
                             "periodic maintenance",
                             "potential(ly)? unauthorized",
                             "refund not approved",
                             "report",
                             "revised.*policy",
                             "scam",
                             "scanned.?invoice",
                             "secured?.update",
                             "security breach",
                             "securlty",
                             "signed.*delivery",
                             "status of your .{314}? ?delivery",
                             "susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty",
                             "suspicious.*sign.*[io]n",
                             "suspicious.activit",
                             "temporar(il)?y deactivate",
                             "temporar[il1]{2}y disab[li]ed",
                             "temporarily.*lock",
                             "un-?usua[li].activity",
                             "unable.*deliver",
                             "unauthorized.*activit",
                             "unauthorized.device",
                             "undelivered message",
                             "unread.*doc",
                             "unusual.activity",
                             "upgrade.*account",
                             "upgrade.notice",
                             "urgent message",
                             "urgent.verification",
                             "v[il1]o[li1]at[il1]on security",
                             "va[il1]{1}date.*ma[il1]{2}[ -]?box",
                             "verification ?-?require",
                             "verification( )?-?need",
                             "verify.your?.account",
                             "web ?-?ma[il1]{2}",
                             "web[ -]?ma[il1]{2}",
                             "will.be.suspended",
                             "your (customer )?account .as",
                             "your.office.365",
                             "your.online.access",
          )
        )
)
// exclude bounce backs & read receipts
and not strings.ilike(sender.email.local_part,
                      "*postmaster*",
                      "*mailer-daemon*",
                      "*administrator*"
)
// exclude optonline deprecated mailbox returns
and (
  not strings.starts_with(sender.display_name, "Auto-reply")
  and sender.email.domain.root_domain == "optonline.net"
)
and not regex.icontains(subject.subject, "^(undeliverable|read:)")
and not any(attachments, .content_type == "message/delivery-status")
// if the "References" is in the body of the message, it's probably a bounce
and not any(headers.references, strings.contains(body.html.display_text, .))
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and not profile.by_sender().any_messages_benign

Detection logic

Scope: inbound message.

Attached EML links to a credential phishing site or exhibits unusual behavior such as multiple suspicious redirects.

  1. inbound message
  2. length(attachments) is 1
  3. any of attachments where all hold:
    • any of:
      • .content_type is 'message/rfc822'
      • .file_extension is 'eml'
    • any of file.parse_eml(.).body.links where any holds:
      • all of:
        • ml.link_analysis(.).credphish.disposition is 'phishing'
        • ml.link_analysis(.).credphish.confidence in ('medium', 'high')
      • any of ml.link_analysis(.).final_dom.links where any holds:
        • .href_url.domain.tld in $suspicious_tlds
        • ml.link_analysis(.href_url).effective_url.domain.tld in $suspicious_tlds
      • any of ml.link_analysis(., mode='aggressive').redirect_history where:
        • .domain.tld in $suspicious_tlds
      • all of:
        • length(distinct(map(ml.link_analysis(., mode='aggressive').redirect_history, .domain.tld))) ≥ 2
        • length(distinct(map(ml.link_analysis(., mode='aggressive').redirect_history, .domain.domain))) ≥ 3
    • any of:
      • any of ml.nlu_classifier(body.current_thread.text).entities where:
        • .name is 'request'
      • any of ml.nlu_classifier(file.parse_eml(.).body.current_thread.text).entities where:
        • .name is 'request'
      • any of recipients.to where all hold:
        • .email.domain.sld in $org_slds
        • any of:
          • strings.icontains(subject.subject)
          • strings.icontains(sender.display_name)
      • any of headers.reply_to where all hold:
        • length(headers.reply_to) > 0
        • all of headers.reply_to where all hold:
          • .email.domain.root_domain is not sender.email.domain.root_domain
          • .email.domain.root_domain in $free_email_providers
      • any of $suspicious_subjects where:
        • strings.icontains(subject.subject)
      • subject.subject matches any of 123 patterns
        • termination.*notice
        • 38417
        • :completed
        • [il1]{2}mit.*ma[il1]{2} ?bo?x
        • [il][il][il]egai[ -]
        • [li][li][li]ega[li] attempt
        • [ng]-?[io]n .*block
        • [ng]-?[io]n .*cancel
        • [ng]-?[io]n .*deactiv
        • [ng]-?[io]n .*disabl
        • action.*required
        • abandon.*package
        • about.your.account
        • acc(ou)?n?t (is )?on ho[li]d
        • acc(ou)?n?t.*terminat
        • acc(oun)?t.*[il1]{2}mitation
        • access.*limitation
        • account (will be )?block
        • account.*de-?activat
        • account.*locked
        • account.*re-verification
        • account.*security
        • account.*suspension
        • account.has.been
        • account.has.expired
        • account.will.be.blocked
        • account v[il]o[li]at
        • activity.*acc(oun)?t
        • almost.full
        • app[li]e.[il]d
        • authenticate.*account
        • been.*suspend
        • clos.*of.*account.*processed
        • confirm.your.account
        • courier.*able
        • crediential.*notif
        • deactivation.*in.*progress
        • delivery.*attempt.*failed
        • document.received
        • documented.*shared.*with.*you
        • dropbox.*document
        • e-?ma[il1]+ .{010}suspen
        • e-?ma[il1]{1} user
        • e-?ma[il1]{2} acc
        • e-?ma[il1]{2}.*up.?grade
        • e.?ma[il1]{2}.*server
        • e.?ma[il1]{2}.*suspend
        • email.update
        • faxed you
        • fraud(ulent)?.*charge
        • from.helpdesk
        • fu[il1]{2}.*ma[il1]+[ -]?box
        • has.been.*suspended
        • has.been.limited
        • have.locked
        • he[li]p ?desk upgrade
        • heipdesk
        • i[il]iega[il]
        • ii[il]ega[il]
        • incoming e?mail
        • incoming.*fax
        • lock.*security
        • ma[il1]{1}[ -]?box.*quo
        • ma[il1]{2}[ -]?box.*fu[il1]
        • ma[il1]{2}box.*[il1]{2}mit
        • ma[il1]{2}box stor
        • mail on.?hold
        • mail.*box.*migration
        • mail.*de-?activat
        • mail.update.required
        • mails.*pending
        • messages.*pending
        • missed.*shipping.*notification
        • missed.shipment.notification
        • must.update.your.account
        • new [sl][io]g?[nig][ -]?in from
        • new voice ?-?mail
        • notifications.*pending
        • office.*3.*6.*5.*suspend
        • office365
        • on google docs with you
        • online doc
        • password.*compromised
        • periodic maintenance
        • potential(ly)? unauthorized
        • refund not approved
        • report
        • revised.*policy
        • scam
        • scanned.?invoice
        • secured?.update
        • security breach
        • securlty
        • signed.*delivery
        • status of your .{314}? ?delivery
        • susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty
        • suspicious.*sign.*[io]n
        • suspicious.activit
        • temporar(il)?y deactivate
        • temporar[il1]{2}y disab[li]ed
        • temporarily.*lock
        • un-?usua[li].activity
        • unable.*deliver
        • unauthorized.*activit
        • unauthorized.device
        • undelivered message
        • unread.*doc
        • unusual.activity
        • upgrade.*account
        • upgrade.notice
        • urgent message
        • urgent.verification
        • v[il1]o[li1]at[il1]on security
        • va[il1]{1}date.*ma[il1]{2}[ -]?box
        • verification ?-?require
        • verification( )?-?need
        • verify.your?.account
        • web ?-?ma[il1]{2}
        • web[ -]?ma[il1]{2}
        • will.be.suspended
        • your (customer )?account .as
        • your.office.365
        • your.online.access
  4. not:
    • sender.email.local_part matches any of 3 patterns
      • *postmaster*
      • *mailer-daemon*
      • *administrator*
  5. all of:
    • not:
      • sender.display_name starts with 'Auto-reply'
    • sender.email.domain.root_domain is 'optonline.net'
  6. not:
    • subject.subject matches '^(undeliverable|read:)'
  7. not:
    • any of attachments where:
      • .content_type is 'message/delivery-status'
  8. not:
    • any of headers.references where:
      • strings.contains(body.html.display_text)
  9. any of:
    • not:
      • profile.by_sender().solicited
    • all of:
      • profile.by_sender().any_messages_malicious_or_spam
      • not:
        • profile.by_sender().any_messages_benign
  10. not:
    • profile.by_sender().any_messages_benign

Inspects: attachments[].content_type, attachments[].file_extension, body.current_thread.text, body.html.display_text, headers.references, headers.reply_to, headers.reply_to[].email.domain.root_domain, recipients.to, recipients.to[].email.domain.sld, sender.display_name, sender.email.domain.root_domain, sender.email.local_part, subject.subject, type.inbound. Sensors: file.parse_eml, ml.link_analysis, ml.nlu_classifier, profile.by_sender, regex.icontains, strings.contains, strings.icontains, strings.ilike, strings.starts_with. Reference lists: $free_email_providers, $org_slds, $suspicious_subjects, $suspicious_tlds.

Indicators matched (134)

FieldMatchValue
attachments[].content_typeequalsmessage/rfc822
attachments[].file_extensionequalseml
ml.nlu_classifier(body.current_thread.text).entities[].nameequalsrequest
ml.nlu_classifier(file.parse_eml(attachments[]).body.current_thread.text).entities[].nameequalsrequest
regex.icontainsregextermination.*notice
regex.icontainsregex38417
regex.icontainsregex:completed
regex.icontainsregex[il1]{2}mit.*ma[il1]{2} ?bo?x
regex.icontainsregex[il][il][il]egai[ -]
regex.icontainsregex[li][li][li]ega[li] attempt
regex.icontainsregex[ng]-?[io]n .*block
regex.icontainsregex[ng]-?[io]n .*cancel
122 more
regex.icontainsregex[ng]-?[io]n .*deactiv
regex.icontainsregex[ng]-?[io]n .*disabl
regex.icontainsregexaction.*required
regex.icontainsregexabandon.*package
regex.icontainsregexabout.your.account
regex.icontainsregexacc(ou)?n?t (is )?on ho[li]d
regex.icontainsregexacc(ou)?n?t.*terminat
regex.icontainsregexacc(oun)?t.*[il1]{2}mitation
regex.icontainsregexaccess.*limitation
regex.icontainsregexaccount (will be )?block
regex.icontainsregexaccount.*de-?activat
regex.icontainsregexaccount.*locked
regex.icontainsregexaccount.*re-verification
regex.icontainsregexaccount.*security
regex.icontainsregexaccount.*suspension
regex.icontainsregexaccount.has.been
regex.icontainsregexaccount.has.expired
regex.icontainsregexaccount.will.be.blocked
regex.icontainsregexaccount v[il]o[li]at
regex.icontainsregexactivity.*acc(oun)?t
regex.icontainsregexalmost.full
regex.icontainsregexapp[li]e.[il]d
regex.icontainsregexauthenticate.*account
regex.icontainsregexbeen.*suspend
regex.icontainsregexclos.*of.*account.*processed
regex.icontainsregexconfirm.your.account
regex.icontainsregexcourier.*able
regex.icontainsregexcrediential.*notif
regex.icontainsregexdeactivation.*in.*progress
regex.icontainsregexdelivery.*attempt.*failed
regex.icontainsregexdocument.received
regex.icontainsregexdocumented.*shared.*with.*you
regex.icontainsregexdropbox.*document
regex.icontainsregexe-?ma[il1]+ .{010}suspen
regex.icontainsregexe-?ma[il1]{1} user
regex.icontainsregexe-?ma[il1]{2} acc
regex.icontainsregexe-?ma[il1]{2}.*up.?grade
regex.icontainsregexe.?ma[il1]{2}.*server
regex.icontainsregexe.?ma[il1]{2}.*suspend
regex.icontainsregexemail.update
regex.icontainsregexfaxed you
regex.icontainsregexfraud(ulent)?.*charge
regex.icontainsregexfrom.helpdesk
regex.icontainsregexfu[il1]{2}.*ma[il1]+[ -]?box
regex.icontainsregexhas.been.*suspended
regex.icontainsregexhas.been.limited
regex.icontainsregexhave.locked
regex.icontainsregexhe[li]p ?desk upgrade
regex.icontainsregexheipdesk
regex.icontainsregexi[il]iega[il]
regex.icontainsregexii[il]ega[il]
regex.icontainsregexincoming e?mail
regex.icontainsregexincoming.*fax
regex.icontainsregexlock.*security
regex.icontainsregexma[il1]{1}[ -]?box.*quo
regex.icontainsregexma[il1]{2}[ -]?box.*fu[il1]
regex.icontainsregexma[il1]{2}box.*[il1]{2}mit
regex.icontainsregexma[il1]{2}box stor
regex.icontainsregexmail on.?hold
regex.icontainsregexmail.*box.*migration
regex.icontainsregexmail.*de-?activat
regex.icontainsregexmail.update.required
regex.icontainsregexmails.*pending
regex.icontainsregexmessages.*pending
regex.icontainsregexmissed.*shipping.*notification
regex.icontainsregexmissed.shipment.notification
regex.icontainsregexmust.update.your.account
regex.icontainsregexnew [sl][io]g?[nig][ -]?in from
regex.icontainsregexnew voice ?-?mail
regex.icontainsregexnotifications.*pending
regex.icontainsregexoffice.*3.*6.*5.*suspend
regex.icontainsregexoffice365
regex.icontainsregexon google docs with you
regex.icontainsregexonline doc
regex.icontainsregexpassword.*compromised
regex.icontainsregexperiodic maintenance
regex.icontainsregexpotential(ly)? unauthorized
regex.icontainsregexrefund not approved
regex.icontainsregexreport
regex.icontainsregexrevised.*policy
regex.icontainsregexscam
regex.icontainsregexscanned.?invoice
regex.icontainsregexsecured?.update
regex.icontainsregexsecurity breach
regex.icontainsregexsecurlty
regex.icontainsregexsigned.*delivery
regex.icontainsregexstatus of your .{314}? ?delivery
regex.icontainsregexsusp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty
regex.icontainsregexsuspicious.*sign.*[io]n
regex.icontainsregexsuspicious.activit
regex.icontainsregextemporar(il)?y deactivate
regex.icontainsregextemporar[il1]{2}y disab[li]ed
regex.icontainsregextemporarily.*lock
regex.icontainsregexun-?usua[li].activity
regex.icontainsregexunable.*deliver
regex.icontainsregexunauthorized.*activit
regex.icontainsregexunauthorized.device
regex.icontainsregexundelivered message
regex.icontainsregexunread.*doc
regex.icontainsregexunusual.activity
regex.icontainsregexupgrade.*account
regex.icontainsregexupgrade.notice
regex.icontainsregexurgent message
regex.icontainsregexurgent.verification
regex.icontainsregexv[il1]o[li1]at[il1]on security
regex.icontainsregexva[il1]{1}date.*ma[il1]{2}[ -]?box
regex.icontainsregexverification ?-?require
regex.icontainsregexverification( )?-?need
regex.icontainsregexverify.your?.account
regex.icontainsregexweb ?-?ma[il1]{2}
regex.icontainsregexweb[ -]?ma[il1]{2}
regex.icontainsregexwill.be.suspended
regex.icontainsregexyour (customer )?account .as
regex.icontainsregexyour.office.365
regex.icontainsregexyour.online.access
strings.ilikesubstring*postmaster*
strings.ilikesubstring*mailer-daemon*
strings.ilikesubstring*administrator*
strings.starts_withprefixAuto-reply
sender.email.domain.root_domainequalsoptonline.net
regex.icontainsregex^(undeliverable|read:)
attachments[].content_typeequalsmessage/delivery-status