Detection rules › Sublime MQL
Credential phishing: Hyper-linked image leading to free file host
This rule detects messages with short or null bodies, where all attachments are images, and the image is hyperlinking to a free_file_host from an unsolicited and untrusted sender.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Free file host, Image as content, Social engineering |
Event coverage
Rule body MQL
type.inbound
and length(body.links) > 0
and 0 < length(attachments) < 8
and all(attachments, .file_type in $file_types_images and .size > 2000)
and any(body.links,
// fingerprints of a hyperlinked image
.display_text is null
and .display_url.url is null
and .href_url.domain.root_domain in $free_file_hosts
)
and (
// body text is very short
(
0 <= (length(body.current_thread.text)) < 10
or body.current_thread.text is null
)
or (
length(body.current_thread.text) < 900
// or body is most likely all warning banner (text contains the sender and common warning banner language)
and (
(
strings.contains(body.current_thread.text, sender.email.email)
and strings.contains(body.current_thread.text, 'caution')
)
or regex.icontains(body.current_thread.text,
"intended recipient's use only|external email|sent from outside|you don't often|confidential"
)
)
)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and (
any(distinct(headers.hops, .authentication_results.dmarc is not null),
strings.ilike(.authentication_results.dmarc, "*fail")
)
)
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
// not solicited or previously flagged malicious/spam
and (
not profile.by_sender().solicited
or profile.by_sender().any_messages_malicious_or_spam
)
// negate legitimate canva emails
and not (
strings.contains(sender.display_name, "via Canva")
and sender.email.domain.domain == "canva.com"
and (
any(distinct(headers.hops, .authentication_results.dmarc is not null),
strings.ilike(.authentication_results.dmarc, "*pass")
)
)
)
Detection logic
Scope: inbound message.
This rule detects messages with short or null bodies, where all attachments are images, and the image is hyperlinking to a free_file_host from an unsolicited and untrusted sender.
- inbound message
- length(body.links) > 0
all of:
- length(attachments) > 0
- length(attachments) < 8
all of
attachmentswhere all hold:- .file_type in $file_types_images
- .size > 2000
any of
body.linkswhere all hold:- .display_text is missing
- .display_url.url is missing
- .href_url.domain.root_domain in $free_file_hosts
any of:
any of:
all of:
- length(body.current_thread.text) ≥ 0
- length(body.current_thread.text) < 10
- body.current_thread.text is missing
all of:
- length(body.current_thread.text) < 900
any of:
all of:
- strings.contains(body.current_thread.text)
- body.current_thread.text contains 'caution'
- body.current_thread.text matches "intended recipient's use only|external email|sent from outside|you don't often|confidential"
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
any of
distinct(headers.hops)where:- .authentication_results.dmarc matches '*fail'
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
any of:
not:
- profile.by_sender().solicited
- profile.by_sender().any_messages_malicious_or_spam
not:
all of:
- sender.display_name contains 'via Canva'
- sender.email.domain.domain is 'canva.com'
any of
distinct(headers.hops)where:- .authentication_results.dmarc matches '*pass'
Inspects: attachments[].file_type, attachments[].size, body.current_thread.text, body.links, body.links[].display_text, body.links[].display_url.url, body.links[].href_url.domain.root_domain, headers.hops, headers.hops[].authentication_results.dmarc, sender.display_name, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: profile.by_sender, regex.icontains, strings.contains, strings.ilike. Reference lists: $file_types_images, $free_file_hosts, $high_trust_sender_root_domains.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
strings.contains | substring | caution |
regex.icontains | regex | intended recipient's use only|external email|sent from outside|you don't often|confidential |
strings.ilike | substring | *fail |
strings.contains | substring | via Canva |
sender.email.domain.domain | equals | canva.com |
strings.ilike | substring | *pass |