Detection rules › Sublime MQL
Brand impersonation: Zoom with deceptive link display
Detects messages mentioning Zoom in the subject or body that contain links appearing to go to zoom.us but actually redirect to different domains.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Impersonation: Brand |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
and sender.email.domain.root_domain in $free_email_providers
and any([subject.base, body.current_thread.text], strings.icontains(., "zoom"))
and any(filter(body.current_thread.links,
strings.icontains(.href_url.url, "zoom.us")
),
.href_url.domain.root_domain not in ("zoom.us", "zoom.com")
and .display_url.domain.root_domain not in ("zoom.us", "zoom.com")
)
Detection logic
Scope: inbound message.
Detects messages mentioning Zoom in the subject or body that contain links appearing to go to zoom.us but actually redirect to different domains.
- inbound message
- sender.email.domain.root_domain in $free_email_providers
any of
[subject.base, body.current_thread.text]where:- . contains 'zoom'
any of
filter(body.current_thread.links)where all hold:- .href_url.domain.root_domain not in ('zoom.us', 'zoom.com')
- .display_url.domain.root_domain not in ('zoom.us', 'zoom.com')
Inspects: body.current_thread.links, body.current_thread.links[].href_url.url, body.current_thread.text, sender.email.domain.root_domain, subject.base, type.inbound. Sensors: strings.icontains. Reference lists: $free_email_providers.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | zoom |
strings.icontains | substring | zoom.us |
filter(body.current_thread.links)[].href_url.domain.root_domain | member | zoom.us |
filter(body.current_thread.links)[].href_url.domain.root_domain | member | zoom.com |
filter(body.current_thread.links)[].display_url.domain.root_domain | member | zoom.us |
filter(body.current_thread.links)[].display_url.domain.root_domain | member | zoom.com |