Attachment: QR code with suspicious URL patterns in EML file

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects EML attachments containing QR codes that link to URLs with suspicious patterns, including specific alphanumeric combinations in subdomains and paths, or special characters followed by encoded terminators. These patterns are commonly used to evade detection in credential theft attacks.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	QR code, Evasion, Social engineering

Event coverage

Message attribute
recipients
recipients.to (collection)
type

Rule body MQL

type.inbound
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(attachments,
        // Email Attachments
        any(file.parse_eml(.).attachments,
            (
              // looks for office docs in the attached eml
              .file_extension in $file_extensions_macros
              and any(file.explode(.),
                      .scan.qr.type == "url"
                      // QR code URL contains recipient's email (targeting indicator)
                      and any(recipients.to,
                              .email.domain.valid
                              and (
                                // Plaintext email address in URL
                                strings.icontains(..scan.qr.url.url,
                                                  .email.email
                                )
                                // OR base64 encoded email address
                                or any(strings.scan_base64(..scan.qr.url.url,
                                                           format="url",
                                                           ignore_padding=true
                                       ),
                                       strings.icontains(., ..email.email)
                                )
                              )
                      )
                      // a single path
                      and strings.count(.scan.qr.url.path, '/') == 2
                      and (
                        (
                          (
                            strings.contains(.scan.qr.url.path, '/$')
                            or strings.contains(.scan.qr.url.path, '/*')
                            or strings.contains(.scan.qr.url.path, '/#')
                          )
                          // subdomain should contain num{3}alpha or alphanum{3}
                          and regex.icontains(.scan.qr.url.domain.subdomain,
                                              '^(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)(?:$|\.)'
                          )
                          // url path should contain num{3}alpha or alphanum{3}
                          and regex.icontains(.scan.qr.url.path,
                                              '\/(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)\/'
                          )
                        )
                        or (
                          // special char in the path
                          (
                            strings.contains(.scan.qr.url.path, '!')
                            or strings.contains(.scan.qr.url.path, '@')
                          )
                          and (
                            strings.contains(.scan.qr.url.path, '/$')
                            or strings.contains(.scan.qr.url.path, '/*')
                            or strings.contains(.scan.qr.url.path, '/#')
                            // hex dollar sign
                            or strings.icontains(.scan.qr.url.path, '%24')
                            // hex star
                            or strings.icontains(.scan.qr.url.path, '%2A')
                            // hex pound
                            or strings.icontains(.scan.qr.url.path, '%23')
                          )
                          // ensure expected ordering
                          and regex.icontains(.scan.qr.url.url,
                                              '[!@].*(?:[$*]|%2[A43])'
                          )
                        )
                      )
              )
            )
            or (
              // looks for pdfs and images in the attached eml
              //
              // This rule makes use of a beta feature and is subject to change without notice
              // using the beta feature in custom rules is not suggested until it has been formally released
              //
              any(beta.scan_qr(.).items,
                  .type is not null
                  // a single path
                  and strings.count(.url.path, '/') == 2
                  and (
                    (
                      (
                        strings.contains(.url.path, '/$')
                        or strings.contains(.url.path, '/*')
                        or strings.contains(.url.path, '/#')
                      )
                      // subdomain should contain num{3}alpha or alphanum{3}
                      and regex.icontains(.url.domain.subdomain,
                                          '^(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)(?:$|\.)'
                      )
                      // url path should contain num{3}alpha or alphanum{3}
                      and regex.icontains(.url.path,
                                          '\/(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)\/'
                      )
                    )
                    or (
                      // special char in the path
                      (
                        strings.contains(.url.path, '!')
                        or strings.contains(.url.path, '@')
                      )
                      and (
                        strings.contains(.url.path, '/$')
                        or strings.contains(.url.path, '/*')
                        or strings.contains(.url.path, '/#')
                        // hex dollar sign
                        or strings.icontains(.url.path, '%24')
                        // hex star
                        or strings.icontains(.url.path, '%2A')
                        // hex pound
                        or strings.icontains(.url.path, '%23')
                      )
                      // ensure expected ordering
                      and regex.icontains(.url.url, '[!@].*(?:[$*]|%2[A43])')
                    )
                  )
              )
            )
        )
)

Detection logic

Scope: inbound message.

inbound message
length(recipients.to) is 1
recipients.to[0].email.domain.valid
any of attachments where:
- any of file.parse_eml(.).attachments where any holds:
  - all of:
    
    .file_extension in $file_extensions_macros
    any of file.explode(.) where all hold:
    
    .scan.qr.type is 'url'
    any of recipients.to where all hold:
    
    .email.domain.valid
    any of:
    
    strings.icontains(.scan.qr.url.url)
    any of strings.scan_base64(.scan.qr.url.url) where:
    
    strings.icontains(.)
    strings.count(.scan.qr.url.path, '/') is 2
    any of:
    
    all of:
    
    any of:
    
    .scan.qr.url.path contains '/$'
    .scan.qr.url.path contains '/*'
    .scan.qr.url.path contains '/#'
    .scan.qr.url.domain.subdomain matches '^(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)(?:$|\\.)'
    .scan.qr.url.path matches '\\/(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)\\/'
    all of:
    
    any of:
    
    .scan.qr.url.path contains '!'
    .scan.qr.url.path contains '@'
    .scan.qr.url.path contains any of 6 patterns
    
    /$
    /*
    /#
    %24
    %2A
    %23
    .scan.qr.url.url matches '[!@].*(?:[$*]|%2[A43])'
  - any of beta.scan_qr(.).items where all hold:
    
    .type is set
    strings.count(.url.path, '/') is 2
    any of:
    
    all of:
    
    any of:
    
    .url.path contains '/$'
    .url.path contains '/*'
    .url.path contains '/#'
    .url.domain.subdomain matches '^(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)(?:$|\\.)'
    .url.path matches '\\/(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)\\/'
    all of:
    
    any of:
    
    .url.path contains '!'
    .url.path contains '@'
    .url.path contains any of 6 patterns
    
    /$
    /*
    /#
    %24
    %2A
    %23
    .url.url matches '[!@].*(?:[$*]|%2[A43])'

Inspects: recipients.to, recipients.to[0].email.domain.valid, recipients.to[].email.domain.valid, recipients.to[].email.email, type.inbound. Sensors: beta.scan_qr, file.explode, file.parse_eml, regex.icontains, strings.contains, strings.count, strings.icontains, strings.scan_base64. Reference lists: $file_extensions_macros.

Indicators matched (12)

Field	Match	Value
`file.explode(file.parse_eml(attachments[]).attachments[])[].scan.qr.type`	equals	`url`
`strings.contains`	substring	`/$`
`strings.contains`	substring	`/*`
`strings.contains`	substring	`/#`
`regex.icontains`	regex	`^(?:[a-z]+[0-9]{3}\|[0-9]{3}[a-z]+)(?:$\|\.)`
`regex.icontains`	regex	`\/(?:[a-z]+[0-9]{3}\|[0-9]{3}[a-z]+)\/`
`strings.contains`	substring	`!`
`strings.contains`	substring	`@`
`strings.icontains`	substring	`%24`
`strings.icontains`	substring	`%2A`
`strings.icontains`	substring	`%23`
`regex.icontains`	regex	`[!@].(?:[$]\|%2[A43])`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)