Detection rules › Sublime MQL
Attachment: Small text file with link containing recipient email address
Attach text file is less than 1000 bytes and contains a recipients email address. Seen in the wild carrying credential phishing links.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| recipients |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
.content_type in~ ("text/plain", "text")
// negate calendar invites
and not (
.file_extension == "ics"
or .content_type in ("application/ics", "text/calendar")
)
and any(file.explode(.),
.size < 1000
and any(.scan.url.urls,
any(recipients.to,
strings.icontains(..url, .email.email)
and .email.domain.valid
)
)
)
)
Detection logic
Scope: inbound message.
Attach text file is less than 1000 bytes and contains a recipients email address. Seen in the wild carrying credential phishing links.
- inbound message
any of
attachmentswhere all hold:- .content_type in ('text/plain', 'text')
none of:
- .file_extension is 'ics'
- .content_type in ('application/ics', 'text/calendar')
any of
file.explode(.)where all hold:- .size < 1000
any of
.scan.url.urlswhere:any of
recipients.towhere all hold:- strings.icontains(.url)
- .email.domain.valid
Inspects: attachments[].content_type, attachments[].file_extension, recipients.to, recipients.to[].email.domain.valid, recipients.to[].email.email, type.inbound. Sensors: file.explode, strings.icontains.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
attachments[].content_type | member | text/plain |
attachments[].content_type | member | text |
attachments[].file_extension | equals | ics |
attachments[].content_type | member | application/ics |
attachments[].content_type | member | text/calendar |