Detection rules › Sublime MQL
Brand impersonation: Google Meet with malicious link
Detects messages with 'Join with Google Meet' display text that redirects to domains other than meet.google.com.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.current_thread |
| type |
Rule body MQL
type.inbound
and any(body.current_thread.links,
.display_text == "Join with Google Meet"
and not strings.contains(.href_url.domain.domain, "meet.google.com")
)
and (
// finding the logo tag in the html
any(html.xpath(body.html, '//img[@alt="[Optional Logo]"]').nodes,
.raw is not null
)
// OR find the green button
or any(html.xpath(body.html, '//a[contains(@style, "rgb(52,168,83)")]').nodes,
.display_text == "Join with Google Meet"
)
)
// finding the "Guests"/"Join by phone" tables NOT being present in the message is a good way to filter out the legit messages.
and length(html.xpath(body.html,
'//table/tbody/tr/td/h2[contains(@style, "color:rgb(60,64,67)")]'
).nodes
) == 0
// we're filtering out some more "generic" table heading for google meets with this one
and not any(distinct(map(html.xpath(body.html, '//table//h2').nodes,
.inner_text
)
),
. in ("Meeting link", "Join by phone", "Guests")
)
Detection logic
Scope: inbound message.
Detects messages with 'Join with Google Meet' display text that redirects to domains other than meet.google.com.
- inbound message
any of
body.current_thread.linkswhere all hold:- .display_text is 'Join with Google Meet'
not:
- .href_url.domain.domain contains 'meet.google.com'
any of:
any of
html.xpath(body.html, '//img[@alt="[Optional Logo]"]').nodeswhere:- .raw is set
any of
html.xpath(body.html, '//a[contains(@style, "rgb(52,168,83)")]').nodeswhere:- .display_text is 'Join with Google Meet'
- length(html.xpath(body.html, '//table/tbody/tr/td/h2[contains(@style, "color:rgb(60,64,67)")]').nodes) is 0
not:
any of
distinct(...)where:- . in ('Meeting link', 'Join by phone', 'Guests')
Inspects: body.current_thread.links, body.current_thread.links[].display_text, body.current_thread.links[].href_url.domain.domain, body.html, type.inbound. Sensors: html.xpath, strings.contains.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
body.current_thread.links[].display_text | equals | Join with Google Meet |
strings.contains | substring | meet.google.com |
html.xpath(body.html, '//a[contains(@style, "rgb(52,168,83)")]').nodes[].display_text | equals | Join with Google Meet |
distinct(...)[] | member | Meeting link |
distinct(...)[] | member | Join by phone |
distinct(...)[] | member | Guests |