Detection rules › Sublime MQL

Attachment: QR code link with base64-encoded recipient address

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects when an image or macro attachment contains QR codes that, when scanned, lead to URLs containing the recipient's email address. This tactic is used to uniquely track or target specific recipients and serve tailored credential phishing pages.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesQR code, Image as content, Social engineering, Evasion, PDF, Macros

Event coverage

Rule body MQL

type.inbound
and 1 of (
  any(ml.nlu_classifier(subject.subject).intents,
      .name == "cred_theft" and .confidence == "high"
  ),
  body.current_thread.text is null,
  any($org_slds, strings.icontains(sender.display_name, .))
)
and any(attachments,
        (
          .file_type in $file_types_images
          or .file_extension in $file_extensions_macros
          or .file_type == "pdf"
        )
        and any(file.explode(.),
                any(recipients.to,
                    .email.domain.valid
                    and any(beta.scan_base64(..scan.qr.url.url,
                                             format="url",
                                             ignore_padding=true
                            ),
                            strings.icontains(., ..email.email)
                    )
                )
        )
)

Detection logic

Scope: inbound message.

Detects when an image or macro attachment contains QR codes that, when scanned, lead to URLs containing the recipient's email address. This tactic is used to uniquely track or target specific recipients and serve tailored credential phishing pages.

  1. inbound message
  2. at least 1 of:
    • any of ml.nlu_classifier(subject.subject).intents where all hold:
      • .name is 'cred_theft'
      • .confidence is 'high'
    • body.current_thread.text is missing
    • any of $org_slds where:
      • strings.icontains(sender.display_name)
  3. any of attachments where all hold:
    • any of:
      • .file_type in $file_types_images
      • .file_extension in $file_extensions_macros
      • .file_type is 'pdf'
    • any of file.explode(.) where:
      • any of recipients.to where all hold:
        • .email.domain.valid
        • any of beta.scan_base64(.scan.qr.url.url) where:
          • strings.icontains(.)

Inspects: attachments[].file_extension, attachments[].file_type, body.current_thread.text, recipients.to, recipients.to[].email.domain.valid, recipients.to[].email.email, sender.display_name, subject.subject, type.inbound. Sensors: beta.scan_base64, file.explode, ml.nlu_classifier, strings.icontains. Reference lists: $file_extensions_macros, $file_types_images, $org_slds.

Indicators matched (3)

FieldMatchValue
ml.nlu_classifier(subject.subject).intents[].nameequalscred_theft
ml.nlu_classifier(subject.subject).intents[].confidenceequalshigh
attachments[].file_typeequalspdf