detection.wiki

Detection rules › Sublime MQL

Attachment: Office file contains OLE relationship to credential phishing page

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Office file OLE relationship link is a credential page, or contains credential phishing language.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Social engineering

Event coverage

Message attribute
attachments (collection)
type

Rule body MQL

type.inbound
and any(attachments,
        (
          .file_extension in~ $file_extensions_macros
          or (
            .file_extension is null
            and .file_type == "unknown"
            and .content_type == "application/octet-stream"
            and .size < 100000000
          )
        )
        and length(file.oletools(.).relationships) < 500
        and any(file.oletools(.).relationships,
                (
                  any(ml.nlu_classifier(ml.link_analysis(.target_url).final_dom.display_text
                      ).intents,
                      .name == "cred_theft"
                      and .confidence in ("medium", "high")
                  )
                  and .target_url.domain.root_domain not in (
                    "google.com",
                    "goo.gl"
                  )
                  and ml.link_analysis(.target_url).effective_url.domain.domain != "login.microsoftonline.com"
                )
                or ml.link_analysis(.target_url).credphish.disposition == "phishing"
        )
)
and (
  (
    profile.by_sender().prevalence in ("new", "outlier")
    and not profile.by_sender().solicited
  )
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

Detection logic

Scope: inbound message.

Office file OLE relationship link is a credential page, or contains credential phishing language.

  1. inbound message
  2. any of attachments where all hold:
    • any of:
      • .file_extension in $file_extensions_macros
      • all of:
        • .file_extension is missing
        • .file_type is 'unknown'
        • .content_type is 'application/octet-stream'
        • .size < 100000000
    • length(file.oletools(.).relationships) < 500
    • any of file.oletools(.).relationships where any holds:
      • all of:
        • any of ml.nlu_classifier(ml.link_analysis(.target_url).final_dom.display_text).intents where all hold:
          • .name is 'cred_theft'
          • .confidence in ('medium', 'high')
        • .target_url.domain.root_domain not in ('google.com', 'goo.gl')
        • ml.link_analysis(.target_url).effective_url.domain.domain is not 'login.microsoftonline.com'
      • ml.link_analysis(.target_url).credphish.disposition is 'phishing'
  3. any of:
    • all of:
      • profile.by_sender().prevalence in ('new', 'outlier')
      • not:
        • profile.by_sender().solicited
    • all of:
      • profile.by_sender().any_messages_malicious_or_spam
      • not:
        • profile.by_sender().any_messages_benign

Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, attachments[].size, type.inbound. Sensors: file.oletools, ml.link_analysis, ml.nlu_classifier, profile.by_sender. Reference lists: $file_extensions_macros.

Indicators matched (7)

FieldMatchValue
attachments[].file_typeequalsunknown
attachments[].content_typeequalsapplication/octet-stream
ml.nlu_classifier(ml.link_analysis(file.oletools(attachments[]).relationships[].target_url).final_dom.display_text).intents[].nameequalscred_theft
ml.nlu_classifier(ml.link_analysis(file.oletools(attachments[]).relationships[].target_url).final_dom.display_text).intents[].confidencemembermedium
ml.nlu_classifier(ml.link_analysis(file.oletools(attachments[]).relationships[].target_url).final_dom.display_text).intents[].confidencememberhigh
file.oletools(attachments[]).relationships[].target_url.domain.root_domainmembergoogle.com
file.oletools(attachments[]).relationships[].target_url.domain.root_domainmembergoo.gl