detection.wiki

Detection rules › Sublime MQL

Free subdomain link with credential theft indicators

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Message contains a suspicious Recipients pattern, a link that uses a free subdomain provider, and has credential theft language on the linked page.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesFree subdomain host

Event coverage

Message attribute
body
body.links (collection)
recipients
recipients.to (collection)
sender.email
type

Rule body MQL

type.inbound
and any(body.links,
        .href_url.domain.root_domain in $free_subdomain_hosts
        and .href_url.domain.subdomain is not null
        and .href_url.domain.subdomain != "www"
)
and (
  (
    (
      length(recipients.to) == 0
      or all(recipients.to, .display_name == "Undisclosed recipients")
    )
    and length(recipients.cc) == 0
    and length(recipients.bcc) == 0
  )
  or (
    length(recipients.to) == 1
    and any(recipients.to, .email.email == sender.email.email)
  )
  or (
    length(recipients.to) == 0
    and length(recipients.cc) == 0
    and length(recipients.bcc) > 0
  )
)
and any(body.links,
        any(file.explode(ml.link_analysis(.).screenshot),
            any(ml.nlu_classifier(.scan.ocr.raw).intents,
                .name == "cred_theft" and .confidence != "low"
            )
        )
)

Detection logic

Scope: inbound message.

Message contains a suspicious Recipients pattern, a link that uses a free subdomain provider, and has credential theft language on the linked page.

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.domain.root_domain in $free_subdomain_hosts
    • .href_url.domain.subdomain is set
    • .href_url.domain.subdomain is not 'www'
  3. any of:
    • all of:
      • any of:
        • length(recipients.to) is 0
        • all of recipients.to where:
          • .display_name is 'Undisclosed recipients'
      • length(recipients.cc) is 0
      • length(recipients.bcc) is 0
    • all of:
      • length(recipients.to) is 1
      • any of recipients.to where:
        • .email.email is sender.email.email
    • all of:
      • length(recipients.to) is 0
      • length(recipients.cc) is 0
      • length(recipients.bcc) > 0
  4. any of body.links where:
    • any of file.explode(...) where:
      • any of ml.nlu_classifier(.scan.ocr.raw).intents where all hold:
        • .name is 'cred_theft'
        • .confidence is not 'low'

Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.subdomain, recipients.bcc, recipients.cc, recipients.to, recipients.to[].display_name, recipients.to[].email.email, sender.email.email, type.inbound. Sensors: file.explode, ml.link_analysis, ml.nlu_classifier. Reference lists: $free_subdomain_hosts.

Indicators matched (2)

FieldMatchValue
recipients.to[].display_nameequalsUndisclosed recipients
ml.nlu_classifier(file.explode(...)[].scan.ocr.raw).intents[].nameequalscred_theft