Sublime MQL rules: file

Detection logic

Scope: inbound message.

Detects messages impersonating file sharing services that contain template artifacts such as placeholder comments, incomplete HTML elements, and development remnants. The message includes 'shared with you' language and exhibits multiple indicators of being generated from a malicious template including HTML comments with development terms, broken anchor tags, and filename elements that closely match the subject line.

1. inbound message
2. body.current_thread.text contains 'shared with you'
3. any of ml.logo_detect(file.message_screenshot()).brands where all hold:

   • .name in ('Microsoft', 'Dropbox', 'Google')
   • .confidence is 'high'
4. at least 2 of:

   • any of html.xpath(body.html, '//span[@class="file-name"]').nodes where:

     • strings.ilevenshtein(.display_text) < 15
   • any of html.xpath(body.html, '//a[@href="#"]').nodes where:

     • .raw is set
   • any of html.xpath(body.html, '//comment()').nodes where:

     • .raw matches '(optional|section|placeholder|todo|fixme)'
   • any of recipients.to where:

     • strings.icontains(body.current_thread.text)
   • body.html.raw contains 'if the button does not work'
5. any of ml.nlu_classifier(body.current_thread.text).intents where all hold:

   • .name in ('cred_theft', 'bec')
   • .confidence is 'high'
6. not:

   • all of:

     • sender.email.email in ('no-reply@outlook.mail.microsoft', 'azuredevops@microsoft.com')
     • headers.auth_summary.dmarc.pass

Inspects: body.current_thread.text, body.html, body.html.raw, headers.auth_summary.dmarc.pass, recipients.to, recipients.to[].email.local_part, sender.email.email, subject.subject, type.inbound. Sensors: file.message_screenshot, html.xpath, ml.logo_detect, ml.nlu_classifier, regex.icontains, strings.icontains, strings.ilevenshtein.

Indicators matched (10)

Detection logic

Scope: inbound message.

A file sharing link in the body sent from a suspicious sender domain.

1. inbound message
2. any of body.links where all hold:

   • any of:

     • .href_url.domain.domain in $free_file_hosts
     • .href_url.domain.root_domain in $free_file_hosts
   • not:

     • .href_url.domain.domain in $tenant_domains
   • not:

     • any of $file_types_images where:

       • strings.iends_with(.href_url.url)
3. sender.email.domain.tld in $suspicious_tlds
4. not:

   • sender.email.domain.root_domain in ('notion.so', 'cribl.cloud')
5. any of:

   • not:

     • profile.by_sender().solicited
   • all of:

     • profile.by_sender().any_messages_malicious_or_spam
     • not:

       • profile.by_sender().any_messages_benign

Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.url, sender.email.domain.root_domain, sender.email.domain.tld, type.inbound. Sensors: profile.by_sender, strings.concat, strings.iends_with. Reference lists: $file_types_images, $free_file_hosts, $suspicious_tlds, $tenant_domains.

Detection logic

Scope: inbound message.

A file sharing link in the body with a common BEC subject. This rule could be expanded to include additional BEC subjects.

1. inbound message
2. sender.email.domain.root_domain is not 'google.com'
3. not:

   • all of:

     • sender.email.domain.root_domain is 'dropbox.com'
     • headers.auth_summary.dmarc.pass
4. any of body.links where all hold:

   • any of:

     • .href_url.domain.domain in $free_file_hosts
     • .href_url.domain.root_domain in $free_file_hosts
   • not:

     • all of:

       • .href_url.domain.domain is 'docs.google.com'
       • .href_url.path starts with '/forms/'
   • not:

     • .href_url.domain.domain in $tenant_domains
5. subject.subject matches any of 2 patterns

   • immediately
   • urgent
6. any of ml.nlu_classifier(body.current_thread.text).intents where:

   • .name is not 'benign'
7. any of:

   • not:

     • profile.by_sender().solicited
   • all of:

     • profile.by_sender().any_messages_malicious_or_spam
     • not:

       • profile.by_sender().any_messages_benign

Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.path, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender, regex.icontains, strings.istarts_with. Reference lists: $free_file_hosts, $tenant_domains.

Indicators matched (2)