Detection rules › Sublime MQL
Link: Non-standard port 8443 in display URL
Detects links containing port 8443 in the display URL, which may indicate suspicious redirect or hosting infrastructure.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion |
Event coverage
Rule body MQL
type.inbound
and (
// no previous threads
length(body.previous_threads) == 0
// or is a fake thread
or (
(length(headers.references) == 0 or headers.in_reply_to is null)
and (
subject.is_reply
or subject.is_forward
or length(body.previous_threads) > 0
)
)
)
and any(body.links,
strings.contains(.display_url.url, ':8443')
and network.whois(.href_url.domain).days_old <= 365
)
// Negate noreply-spamdigest senders
and not (
sender.email.email == "noreply-spamdigest@google.com"
and headers.auth_summary.dmarc.pass
)
Detection logic
Scope: inbound message.
Detects links containing port 8443 in the display URL, which may indicate suspicious redirect or hosting infrastructure.
- inbound message
any of:
- length(body.previous_threads) is 0
all of:
any of:
- length(headers.references) is 0
- headers.in_reply_to is missing
any of:
- subject.is_reply
- subject.is_forward
- length(body.previous_threads) > 0
any of
body.linkswhere all hold:- .display_url.url contains ':8443'
- network.whois(.href_url.domain).days_old ≤ 365
not:
all of:
- sender.email.email is 'noreply-spamdigest@google.com'
- headers.auth_summary.dmarc.pass
Inspects: body.links, body.links[].display_url.url, body.links[].href_url.domain, body.previous_threads, headers.auth_summary.dmarc.pass, headers.in_reply_to, headers.references, sender.email.email, subject.is_forward, subject.is_reply, type.inbound. Sensors: network.whois, strings.contains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
strings.contains | substring | :8443 |
sender.email.email | equals | noreply-spamdigest@google.com |