detection.wiki

Detection rules › Sublime MQL

Attachment: QR code with encoded recipient targeting and redirect indicators

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects QR codes in attachments that contain the recipient's email address (either plaintext or base64 encoded) and redirect through suspicious URI structures commonly associated with Kratos/SneakyLog redirection services.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesQR code, Evasion, Image as content, Open redirect

Event coverage

Message attribute
attachments (collection)
recipients
recipients.to (collection)
type

Rule body MQL

type.inbound
// QR code detection in attachments
and any(attachments,
        (
          // Office documents
          .file_extension in $file_extensions_macros
          and any(file.explode(.),
                  .scan.qr.type == "url"
                  // QR code URL contains recipient's email (targeting indicator)
                  and any(recipients.to,
                          .email.domain.valid
                          and (
                            // Plaintext email address in URL
                            strings.icontains(..scan.qr.url.url, .email.email)
                            // OR base64 encoded email address
                            or any(strings.scan_base64(..scan.qr.url.url,
                                                       format="url",
                                                       ignore_padding=true
                                   ),
                                   strings.icontains(., ..email.email)
                            )
                          )
                  )
                  // URI Struct for Common Kratos/SneakyLog Redir
                  and regex.contains(.scan.qr.url.url,
                                     '\.(?:c(?:ompany|you)|sbs)(?:[$#]|\?a=)'
                  )
          )
        )
        or (
          // pdf or images
          (
            .file_type == "pdf" or .file_type in $file_types_images
          )
          //
          // This rule makes use of a beta feature and is subject to change without notice
          // using the beta feature in custom rules is not suggested until it has been formally released
          //
          and any(beta.scan_qr(.).items,
                  .type is not null
                  and regex.contains(.url.url,
                                     '\.(?:c(?:ompany|you)|sbs)(?:[$#]|\?a=)'
                  )
          )
        )
)

Detection logic

Scope: inbound message.

Detects QR codes in attachments that contain the recipient's email address (either plaintext or base64 encoded) and redirect through suspicious URI structures commonly associated with Kratos/SneakyLog redirection services.

  1. inbound message
  2. any of attachments where any holds:
    • all of:
      • .file_extension in $file_extensions_macros
      • any of file.explode(.) where all hold:
        • .scan.qr.type is 'url'
        • any of recipients.to where all hold:
          • .email.domain.valid
          • any of:
            • strings.icontains(.scan.qr.url.url)
            • any of strings.scan_base64(.scan.qr.url.url) where:
              • strings.icontains(.)
        • .scan.qr.url.url matches '\\.(?:c(?:ompany|you)|sbs)(?:[$#]|\\?a=)'
    • all of:
      • any of:
        • .file_type is 'pdf'
        • .file_type in $file_types_images
      • any of beta.scan_qr(.).items where all hold:
        • .type is set
        • .url.url matches '\\.(?:c(?:ompany|you)|sbs)(?:[$#]|\\?a=)'

Inspects: attachments[].file_extension, attachments[].file_type, recipients.to, recipients.to[].email.domain.valid, recipients.to[].email.email, type.inbound. Sensors: beta.scan_qr, file.explode, regex.contains, strings.icontains, strings.scan_base64. Reference lists: $file_extensions_macros, $file_types_images.

Indicators matched (3)

FieldMatchValue
file.explode(attachments[])[].scan.qr.typeequalsurl
regex.containsregex\.(?:c(?:ompany|you)|sbs)(?:[$#]|\?a=)
attachments[].file_typeequalspdf