Detection rules › Sublime MQL
Credential phishing: AWS Lambda URL with recipient targeting
Detects messages containing AWS Lambda URLs with the recipient's email address embedded in the fragment, indicating potential abuse of AWS Lambda services for targeted malicious activities.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Free subdomain host, Social engineering |
Event coverage
Rule body MQL
type.inbound
and recipients.to[0].email.domain.sld == sender.email.local_part
and any(body.links,
strings.icontains(.href_url.domain.domain, "lambda-url")
and strings.icontains(.href_url.fragment, recipients.to[0].email.email)
)
Detection logic
Scope: inbound message.
Detects messages containing AWS Lambda URLs with the recipient's email address embedded in the fragment, indicating potential abuse of AWS Lambda services for targeted malicious activities.
- inbound message
- recipients.to[0].email.domain.sld is sender.email.local_part
any of
body.linkswhere all hold:- .href_url.domain.domain contains 'lambda-url'
- strings.icontains(.href_url.fragment)
Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.fragment, recipients.to[0].email.domain.sld, recipients.to[0].email.email, sender.email.local_part, type.inbound. Sensors: strings.icontains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | lambda-url |