Detection rules › Sublime MQL
Fake scan-to-email message
Message resembles an email from a scan-to-email service or device, but does not contain any attachments, instead linking to an unknown domain.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Free file host, Social engineering |
Event coverage
Rule body MQL
type.inbound
and length(attachments) == 0
and 0 < length(body.links) < 3
and strings.ilike(subject.subject, "*message from*")
and (
(
strings.ilike(body.current_thread.text, "*scan date*", "*was sent from*")
and not strings.ilike(body.current_thread.text, "*unmonitored*")
)
or (
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
strings.ilike(beta.ocr(file.message_screenshot()).text,
"*scan date*",
"*was sent from*"
)
and not strings.ilike(beta.ocr(file.message_screenshot()).text,
"*unmonitored*"
)
)
)
and (
any(body.links, .href_url.domain.root_domain in~ $free_file_hosts)
or any(body.links, .display_url.url != .href_url.url)
or any(body.links, .display_url.url is null)
)
and all(body.links,
.href_url.domain.domain not in~ $org_domains
and .href_url.domain.domain not in ("aka.ms")
)
and sender.email.domain.domain not in~ $org_domains
and (
not profile.by_sender().solicited
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
Message resembles an email from a scan-to-email service or device, but does not contain any attachments, instead linking to an unknown domain.
- inbound message
- length(attachments) is 0
all of:
- length(body.links) > 0
- length(body.links) < 3
- subject.subject matches '*message from*'
any of:
all of:
body.current_thread.text matches any of 2 patterns
*scan date**was sent from*
not:
- body.current_thread.text matches '*unmonitored*'
all of:
beta.ocr(file.message_screenshot()).text matches any of 2 patterns
*scan date**was sent from*
not:
- beta.ocr(file.message_screenshot()).text matches '*unmonitored*'
any of:
any of
body.linkswhere:- .href_url.domain.root_domain in $free_file_hosts
any of
body.linkswhere:- .display_url.url is not .href_url.url
any of
body.linkswhere:- .display_url.url is missing
all of
body.linkswhere all hold:- .href_url.domain.domain not in $org_domains
- .href_url.domain.domain not in ('aka.ms')
- sender.email.domain.domain not in $org_domains
any of:
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
not:
- profile.by_sender().any_messages_benign
Inspects: body.current_thread.text, body.links, body.links[].display_url.url, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.url, sender.email.domain.domain, subject.subject, type.inbound. Sensors: beta.ocr, file.message_screenshot, profile.by_sender, strings.ilike. Reference lists: $free_file_hosts, $org_domains.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | *message from* |
strings.ilike | substring | *scan date* |
strings.ilike | substring | *was sent from* |
strings.ilike | substring | *unmonitored* |
body.links[].href_url.domain.domain | member | aka.ms |