Detection rules › Sublime MQL

Sublime MQL rules: clickfunnels

Rule	Severity
ClickFunnels link infrastructure abuse	`high`

ClickFunnels link infrastructure abuse

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Email contains a ClickFunnels (mass mailing platform) tracking link but does not originate from ClickFunnels sending infrastructure. The myclickfunnels.com domain has been abused by threat actors to attempt credential phishing.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	Free email provider, Free subdomain host, Social engineering

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

attachments
body
body.links
headers
headers.domains
headers.hops
sender.email
subject
type

Rule Body

type.inbound
and (
  (
    length(body.links) < 15
    and any(body.links, .href_url.domain.root_domain == "myclickfunnels.com")
  )
  or (
    length(attachments) <= 3
    and (
      any(attachments,
          (.file_type in $file_types_images or .file_type == "pdf")
          and any(file.explode(.),
                  .scan.qr.type is not null
                  and .scan.qr.url.domain.root_domain == "myclickfunnels.com"
                  // exclude images taken with mobile cameras and screenshots from android
                  and not any(.scan.exiftool.fields,
                              .key == "Model"
                              or (
                                .key == "Software"
                                and strings.starts_with(.value, "Android")
                              )
                  )
                  // exclude images taken with mobile cameras and screenshots from Apple
                  and not any(.scan.exiftool.fields,
                              .key == "DeviceManufacturer"
                              and .value == "Apple Computer Inc."
                  )
          )
      )
      or (
        length(attachments) == 0
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and beta.parse_exif(file.message_screenshot()).image_height < 2000
        and beta.parse_exif(file.message_screenshot()).image_width < 2000
        and any(beta.scan_qr(file.message_screenshot()).items,
                .type is not null
                and .url.domain.root_domain == "myclickfunnels.com"
        )
      )
    )
  )
  or (
    length(attachments) <= 3
    and (
      any(attachments,
          (
            .file_type in ("pdf")
            or .file_extension in ("pdf", "eml")
            or .file_extension in $file_extensions_macros
            or (
              .content_type in ("message/rfc822") or .file_extension in ('eml')
            )
          )
          and any(file.explode(.),
                  any(.scan.url.urls,
                      .domain.root_domain == "myclickfunnels.com"
                  )
          )
      )
    )
  )
)
and not (
  any(headers.domains, strings.ends_with(.domain, "mailer.myclickfunnels.com"))
  or (
    (
      any(headers.hops,
          .index == 0
          and any(.authentication_results.dkim_details,
                  .domain == "mailer.myclickfunnels.com"
          )
      )
    )
    and any(distinct(headers.hops, .authentication_results.dmarc is not null),
            .index == 0
            and strings.ilike(.authentication_results.dmarc, "*pass")
    )
  )
)
// negating legit replies
and not (
  (
    strings.istarts_with(subject.subject, "RE:")
    or strings.istarts_with(subject.subject, "FW:")
    or strings.istarts_with(subject.subject, "FWD:")
    or strings.istarts_with(subject.subject, "Automatic reply:")
  )
  and (length(headers.references) > 0 and headers.in_reply_to is not null)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and (
      any(distinct(headers.hops, .authentication_results.dmarc is not null),
          strings.ilike(.authentication_results.dmarc, "*fail")
      )
    )
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection Logic

Scope: inbound message.

inbound message
any of:
- all of:
  - length(body.links) < 15
  - any of body.links where:
    
    .href_url.domain.root_domain is 'myclickfunnels.com'
- all of:
  - length(attachments) <= 3
  - any of:
    
    any of attachments where all hold:
    
    any of:
    
    .file_type in $file_types_images
    .file_type is 'pdf'
    any(file.explode(.), .scan.qr.type is not null and .scan.qr.url.domain.root_domain == "myclickfunnels.com" // exclude images taken with mobile cameras and screenshots from android and not any(.scan.exiftool.fields, .key == "Model" or ( .key == "Software" and strings.starts_with(.value, "Android") ) ) // exclude images taken with mobile cameras and screenshots from Apple and not any(.scan.exiftool.fields, .key == "DeviceManufacturer" and .value == "Apple Computer Inc." ) )
    all of:
    
    length(attachments) == 0
    beta.parse_exif(file.message_screenshot()).image_height < 2000
    beta.parse_exif(file.message_screenshot()).image_width < 2000
    any(beta.scan_qr(file.message_screenshot()).items, .type is not null and .url.domain.root_domain == "myclickfunnels.com" )
- all of:
  - length(attachments) <= 3
  - any of attachments where all hold:
    
    any of:
    
    .file_type in ('pdf')
    .file_extension in ('pdf', 'eml')
    .file_extension in $file_extensions_macros
    any of:
    
    .content_type in ('message/rfc822')
    .file_extension in ('eml')
    any(file.explode(.), any(.scan.url.urls, .domain.root_domain == "myclickfunnels.com" ) )
none of:
- any of headers.domains where:
  - .domain ends with 'mailer.myclickfunnels.com'
- all of:
  - any of headers.hops where all hold:
    
    .index is 0
    any of .authentication_results.dkim_details where:
    
    .domain is 'mailer.myclickfunnels.com'
  - any(distinct(headers.hops, .authentication_results.dmarc is not null), .index == 0 and strings.ilike(.authentication_results.dmarc, "*pass") )
not:
- all of:
  - subject.subject starts with any of 4 patterns
    
    RE:
    FW:
    FWD:
    Automatic reply:
  - all of:
    
    length(headers.references) > 0
    headers.in_reply_to is set
any of:
- all of:
  - sender.email.domain.root_domain in $high_trust_sender_root_domains
  - ( any(distinct(headers.hops, .authentication_results.dmarc is not null), strings.ilike(.authentication_results.dmarc, "*fail") ) )
- sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, body.links, body.links[].href_url.domain.root_domain, headers.domains, headers.domains[].domain, headers.hops, headers.hops[].authentication_results.dkim_details, headers.hops[].authentication_results.dkim_details[].domain, headers.hops[].authentication_results.dmarc, headers.hops[].index, headers.in_reply_to, headers.references, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: beta.parse_exif, beta.scan_qr, file.explode, file.message_screenshot, strings.ends_with, strings.ilike, strings.istarts_with, strings.starts_with. Reference lists: $file_extensions_macros, $file_types_images, $high_trust_sender_root_domains.

Indicators Matched (10)

Field	Match	Value
`body.links[].href_url.domain.root_domain`	equals	`myclickfunnels.com`
`attachments[].file_type`	equals	`pdf`
`file.explode(attachments[])[].scan.qr.url.domain.root_domain`	equals	`myclickfunnels.com`
`beta.scan_qr(file.message_screenshot()).items[].url.domain.root_domain`	equals	`myclickfunnels.com`
`attachments[].file_type`	member	`pdf`
`attachments[].file_extension`	member	`pdf`
`attachments[].file_extension`	member	`eml`
`attachments[].content_type`	member	`message/rfc822`
`file.explode(attachments[])[].scan.url.urls[].domain.root_domain`	equals	`myclickfunnels.com`
`strings.ilike`	substring	`*fail`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    and
      or
        any(attachments)
          and
            or
              attachments.file_type eq "pdf"
              attachments.file_type macro "attachments[].file_type in file_types_images"
             macro "any(file.explode(.),\n                  .scan.qr.type is not null\n                  and .scan.qr.url.domain.root_domain == \"myclickfunnels.com\"\n                  // exclude images taken with mobile cameras and screenshots from android\n                  and not any(.scan.exiftool.fields,\n                              .key == \"Model\"\n                              or (\n                                .key == \"Software\"\n                                and strings.starts_with(.value, \"Android\")\n                              )\n                  )\n                  // exclude images taken with mobile cameras and screenshots from Apple\n                  and not any(.scan.exiftool.fields,\n                              .key == \"DeviceManufacturer\"\n                              and .value == \"Apple Computer Inc.\"\n                  )\n          )"
        and
          attachments length_compare "0"
          beta.parse_exif func_call "beta.parse_exif(file.message_screenshot()).image_height < 2000"
          beta.parse_exif func_call "beta.parse_exif(file.message_screenshot()).image_width < 2000"
           macro "any(beta.scan_qr(file.message_screenshot()).items,\n                .type is not null\n                and .url.domain.root_domain == \"myclickfunnels.com\"\n        )"
      attachments length_compare "3"
    and
      any(attachments)
        and
          or
            attachments.content_type eq "message/rfc822"
            attachments.file_extension eq "eml"
            attachments.file_extension in ["eml", "pdf"]
            attachments.file_extension macro "attachments[].file_extension in file_extensions_macros"
            attachments.file_type eq "pdf"
           macro "any(file.explode(.),\n                  any(.scan.url.urls,\n                      .domain.root_domain == \"myclickfunnels.com\"\n                  )\n          )"
      attachments length_compare "3"
    and
      any(body.links)
        body.links.href_url.domain.root_domain eq "myclickfunnels.com"
      body.links length_compare "15"
  not
    or
      and
        any(headers.hops)
          and
            any(headers.hops.authentication_results.dkim_details)
              headers.hops.authentication_results.dkim_details.domain eq "mailer.myclickfunnels.com"
            headers.hops.index eq "0"
         macro "any(distinct(headers.hops, .authentication_results.dmarc is not null),\n            .index == 0\n            and strings.ilike(.authentication_results.dmarc, \"*pass\")\n    )"
      any(headers.domains)
        headers.domains.domain ends_with "mailer.myclickfunnels.com"
  not
    and
      or
        subject.subject starts_with "Automatic reply:"
        subject.subject starts_with "FW:"
        subject.subject starts_with "FWD:"
        subject.subject starts_with "RE:"
      headers.in_reply_to is_not_null
      headers.references length_compare "0"
  or
    and
      sender.email.domain.root_domain macro "sender.email.domain.root_domain in high_trust_sender_root_domains"
       macro "(\n      any(distinct(headers.hops, .authentication_results.dmarc is not null),\n          strings.ilike(.authentication_results.dmarc, \"*fail\")\n      )\n    )"
    sender.email.domain.root_domain macro "sender.email.domain.root_domain not in high_trust_sender_root_domains"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean` corpus 1212 (mql 1212)	`field:"type.inbound" kind:eq value:"true"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`headers.hops`	array_any	(no value, null check)	`excludes:headers.hops`
`headers.domains`	array_any	(no value, null check)	`excludes:headers.domains`
`subject.subject`	starts_with	`Automatic reply:`	`excludes:subject.subject` `field:"subject.subject" value:"Automatic reply:"`
`subject.subject`	starts_with	`FW:`	`excludes:subject.subject` `field:"subject.subject" value:"FW:"`
`subject.subject`	starts_with	`FWD:`	`excludes:subject.subject` `field:"subject.subject" value:"FWD:"`
`subject.subject`	starts_with	`RE:`	`excludes:subject.subject` `field:"subject.subject" value:"RE:"`
`headers.in_reply_to`	is_not_null	(no value, null check)	`excludes:headers.in_reply_to`
`headers.references`	length_compare	`0`	`excludes:headers.references` `field:"headers.references" value:"0"`

Back to all Sublime MQL rules