Detection rules › Sublime MQL

Fake Zoho Sign template abuse

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule captures credential phishing attempts abusing the Zoho Sign template. The rule looks for artifacts of the Hijacked Zoho link and other template constructs.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Open redirect, Social engineering

Event coverage

Rule body MQL

type.inbound
and 0 < length(body.links) < 10
// Link contains Start Signing
and any(body.links, .display_text == "Start Signing")

// Zoho artifact in html body
and regex.contains(body.html.raw,
                   'title="Original URL: https:\/\/sign\.zoho\.com\/zsguest\?[^"]*action_type=SIGN\.[^"]*Click or tap if you trust this link\."'
)
// but the Zoho link is not active
and not any(body.links, .href_url.domain.root_domain == "zoho.com")

// and the body thread contains the Sender + recipient domain
and any(recipients.to,
        strings.icontains(body.current_thread.text,
                          strings.concat("Sender\n", .email.domain.domain)
        )
)

Detection logic

Scope: inbound message.

This rule captures credential phishing attempts abusing the Zoho Sign template. The rule looks for artifacts of the Hijacked Zoho link and other template constructs.

  1. inbound message
  2. all of:
    • length(body.links) > 0
    • length(body.links) < 10
  3. any of body.links where:
    • .display_text is 'Start Signing'
  4. body.html.raw matches 'title="Original URL: https:\\/\\/sign\\.zoho\\.com\\/zsguest\\?[^"]*action_type=SIGN\\.[^"]*Click or tap if you trust this link\\."'
  5. not:
    • any of body.links where:
      • .href_url.domain.root_domain is 'zoho.com'
  6. any of recipients.to where:
    • strings.icontains(body.current_thread.text)

Inspects: body.current_thread.text, body.html.raw, body.links, body.links[].display_text, body.links[].href_url.domain.root_domain, recipients.to, recipients.to[].email.domain.domain, type.inbound. Sensors: regex.contains, strings.concat, strings.icontains.

Indicators matched (3)

FieldMatchValue
body.links[].display_textequalsStart Signing
regex.containsregextitle="Original URL: https:\/\/sign\.zoho\.com\/zsguest\?[^"]*action_type=SIGN\.[^"]*Click or tap if you trust this link\."
body.links[].href_url.domain.root_domainequalszoho.com