Sublime MQL rules: file

Detection Logic

Scope: inbound message.

Detects messages impersonating file sharing services that contain template artifacts such as placeholder comments, incomplete HTML elements, and development remnants. The message includes 'shared with you' language and exhibits multiple indicators of being generated from a malicious template including HTML comments with development terms, broken anchor tags, and filename elements that closely match the subject line.

1. inbound message
2. body.current_thread.text contains 'shared with you'
3. any(ml.logo_detect(file.message_screenshot()).brands, .name in ('Microsoft', 'Dropbox', 'Google') and .confidence == "high" )
4. at least 2 of:

   • any(html.xpath(body.html, '//span[@class="file-name"]').nodes, strings.ilevenshtein(.display_text, subject.subject) < 15 )
   • any(html.xpath(body.html, '//a[@href="#"]').nodes, .raw is not null)
   • any(html.xpath(body.html, '//comment()').nodes, regex.icontains(.raw, '(optional|section|placeholder|todo|fixme)') )
   • any of recipients.to where:

     • strings.icontains(body.current_thread.text, .email.local_part)
   • body.html.raw contains 'if the button does not work'
5. any(ml.nlu_classifier(body.current_thread.text).intents, .name in ("cred_theft", "bec") and .confidence == "high" )
6. not:

   • all of:

     • sender.email.email in ('no-reply@outlook.mail.microsoft', 'azuredevops@microsoft.com')
     • headers.auth_summary.dmarc.pass

Inspects: body.current_thread.text, body.html, body.html.raw, headers.auth_summary.dmarc.pass, recipients.to, recipients.to[].email.local_part, sender.email.email, subject.subject, type.inbound. Sensors: file.message_screenshot, html.xpath, ml.logo_detect, ml.nlu_classifier, regex.icontains, strings.icontains, strings.ilevenshtein.

Indicators Matched (10)

Detection Logic

Scope: inbound message.

A file sharing link in the body sent from a suspicious sender domain.

1. inbound message
2. any of body.links where all hold:

   • any of:

     • .href_url.domain.domain in $free_file_hosts
     • .href_url.domain.root_domain in $free_file_hosts
   • not:

     • .href_url.domain.domain in $tenant_domains
   • not:

     • any($file_types_images, strings.iends_with(..href_url.url, strings.concat('.', .)) )
3. sender.email.domain.tld in $suspicious_tlds
4. not:

   • sender.email.domain.root_domain in ('notion.so', 'cribl.cloud')
5. any of:

   • not:

     • profile.by_sender().solicited
   • all of:

     • profile.by_sender().any_messages_malicious_or_spam
     • not:

       • profile.by_sender().any_messages_benign

Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.url, sender.email.domain.root_domain, sender.email.domain.tld, type.inbound. Sensors: profile.by_sender, strings.concat, strings.iends_with. Reference lists: $file_types_images, $free_file_hosts, $suspicious_tlds, $tenant_domains.

Detection Logic

Scope: inbound message.

A file sharing link in the body with a common BEC subject. This rule could be expanded to include additional BEC subjects.

1. inbound message
2. sender.email.domain.root_domain is not 'google.com'
3. not:

   • all of:

     • sender.email.domain.root_domain is 'dropbox.com'
     • headers.auth_summary.dmarc.pass
4. any of body.links where all hold:

   • any of:

     • .href_url.domain.domain in $free_file_hosts
     • .href_url.domain.root_domain in $free_file_hosts
   • not:

     • all of:

       • .href_url.domain.domain is 'docs.google.com'
       • .href_url.path starts with '/forms/'
   • not:

     • .href_url.domain.domain in $tenant_domains
5. subject.subject matches any of 2 patterns

   • immediately
   • urgent
6. any(ml.nlu_classifier(body.current_thread.text).intents, .name != "benign")
7. any of:

   • not:

     • profile.by_sender().solicited
   • all of:

     • profile.by_sender().any_messages_malicious_or_spam
     • not:

       • profile.by_sender().any_messages_benign

Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.path, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender, regex.icontains, strings.istarts_with. Reference lists: $free_file_hosts, $tenant_domains.

Indicators Matched (2)