Detection rules › Sublime MQL
Fake Zoho Sign template abuse
This rule captures credential phishing attempts abusing the Zoho Sign template. The rule looks for artifacts of the Hijacked Zoho link and other template constructs.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Open redirect, Social engineering |
Event coverage
Rule body MQL
type.inbound
and 0 < length(body.links) < 10
// Link contains Start Signing
and any(body.links, .display_text == "Start Signing")
// Zoho artifact in html body
and regex.contains(body.html.raw,
'title="Original URL: https:\/\/sign\.zoho\.com\/zsguest\?[^"]*action_type=SIGN\.[^"]*Click or tap if you trust this link\."'
)
// but the Zoho link is not active
and not any(body.links, .href_url.domain.root_domain == "zoho.com")
// and the body thread contains the Sender + recipient domain
and any(recipients.to,
strings.icontains(body.current_thread.text,
strings.concat("Sender\n", .email.domain.domain)
)
)
Detection logic
Scope: inbound message.
This rule captures credential phishing attempts abusing the Zoho Sign template. The rule looks for artifacts of the Hijacked Zoho link and other template constructs.
- inbound message
all of:
- length(body.links) > 0
- length(body.links) < 10
any of
body.linkswhere:- .display_text is 'Start Signing'
- body.html.raw matches 'title="Original URL: https:\\/\\/sign\\.zoho\\.com\\/zsguest\\?[^"]*action_type=SIGN\\.[^"]*Click or tap if you trust this link\\."'
not:
any of
body.linkswhere:- .href_url.domain.root_domain is 'zoho.com'
any of
recipients.towhere:- strings.icontains(body.current_thread.text)
Inspects: body.current_thread.text, body.html.raw, body.links, body.links[].display_text, body.links[].href_url.domain.root_domain, recipients.to, recipients.to[].email.domain.domain, type.inbound. Sensors: regex.contains, strings.concat, strings.icontains.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
body.links[].display_text | equals | Start Signing |
regex.contains | regex | title="Original URL: https:\/\/sign\.zoho\.com\/zsguest\?[^"]*action_type=SIGN\.[^"]*Click or tap if you trust this link\." |
body.links[].href_url.domain.root_domain | equals | zoho.com |