Detection rules › Sublime MQL
Attachment: EML with SharePoint files shared from GoDaddy federated tenants
Detects EML attachments containing SharePoint links with 'netorg' subdomain patterns, which may indicate suspicious redirection tactics or domain abuse.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and length(filter(attachments,
.file_extension == "eml" or .content_type == "message/rfc822"
)
) == 1
and any(attachments,
any(file.parse_eml(.).body.links,
strings.starts_with(.href_url.domain.subdomain, 'netorg')
and .href_url.domain.root_domain == "sharepoint.com"
)
)
Detection logic
Scope: inbound message.
Detects EML attachments containing SharePoint links with 'netorg' subdomain patterns, which may indicate suspicious redirection tactics or domain abuse.
- inbound message
- length(filter(attachments, .file_extension == 'eml' or .content_type == 'message/rfc822')) is 1
any of
attachmentswhere:any of
file.parse_eml(.).body.linkswhere all hold:- .href_url.domain.subdomain starts with 'netorg'
- .href_url.domain.root_domain is 'sharepoint.com'
Inspects: attachments[].content_type, attachments[].file_extension, type.inbound. Sensors: file.parse_eml, strings.starts_with.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | equals | eml |
attachments[].content_type | equals | message/rfc822 |
strings.starts_with | prefix | netorg |
file.parse_eml(attachments[]).body.links[].href_url.domain.root_domain | equals | sharepoint.com |