Detection rules › Sublime MQL
Brand impersonation: File sharing notification with template artifacts
Detects messages impersonating file sharing services that contain template artifacts such as placeholder comments, incomplete HTML elements, and development remnants. The message includes 'shared with you' language and exhibits multiple indicators of being generated from a malicious template including HTML comments with development terms, broken anchor tags, and filename elements that closely match the subject line.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering, Evasion |
Event coverage
Rule body MQL
type.inbound
and strings.icontains(body.current_thread.text, 'shared with you')
// we detect a file sharing logo with high confidence
and any(ml.logo_detect(file.message_screenshot()).brands,
.name in ('Microsoft', 'Dropbox', 'Google') and .confidence == "high"
)
and 2 of (
// the subject is very similar to the name of the file-name html class
any(html.xpath(body.html, '//span[@class="file-name"]').nodes,
strings.ilevenshtein(.display_text, subject.subject) < 15
),
// we detect a href to a # implying a neglected placeholder
any(html.xpath(body.html, '//a[@href="#"]').nodes, .raw is not null),
// we detect "ai-esque" comments
any(html.xpath(body.html, '//comment()').nodes,
regex.icontains(.raw, '(optional|section|placeholder|todo|fixme)')
),
// recipients local part is in the body of the message
any(recipients.to,
strings.icontains(body.current_thread.text, .email.local_part)
),
strings.icontains(body.html.raw, 'if the button does not work')
)
// and cred theft/bec high confidence
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name in ("cred_theft", "bec") and .confidence == "high"
)
// not sent from legitimate Microsoft emails as long as auth passes
and not (
sender.email.email in (
'no-reply@outlook.mail.microsoft',
'azuredevops@microsoft.com'
)
and headers.auth_summary.dmarc.pass
)
Detection logic
Scope: inbound message.
Detects messages impersonating file sharing services that contain template artifacts such as placeholder comments, incomplete HTML elements, and development remnants. The message includes 'shared with you' language and exhibits multiple indicators of being generated from a malicious template including HTML comments with development terms, broken anchor tags, and filename elements that closely match the subject line.
- inbound message
- body.current_thread.text contains 'shared with you'
any of
ml.logo_detect(file.message_screenshot()).brandswhere all hold:- .name in ('Microsoft', 'Dropbox', 'Google')
- .confidence is 'high'
at least 2 of:
any of
html.xpath(body.html, '//span[@class="file-name"]').nodeswhere:- strings.ilevenshtein(.display_text) < 15
any of
html.xpath(body.html, '//a[@href="#"]').nodeswhere:- .raw is set
any of
html.xpath(body.html, '//comment()').nodeswhere:- .raw matches '(optional|section|placeholder|todo|fixme)'
any of
recipients.towhere:- strings.icontains(body.current_thread.text)
- body.html.raw contains 'if the button does not work'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name in ('cred_theft', 'bec')
- .confidence is 'high'
not:
all of:
- sender.email.email in ('no-reply@outlook.mail.microsoft', 'azuredevops@microsoft.com')
- headers.auth_summary.dmarc.pass
Inspects: body.current_thread.text, body.html, body.html.raw, headers.auth_summary.dmarc.pass, recipients.to, recipients.to[].email.local_part, sender.email.email, subject.subject, type.inbound. Sensors: file.message_screenshot, html.xpath, ml.logo_detect, ml.nlu_classifier, regex.icontains, strings.icontains, strings.ilevenshtein.
Indicators matched (12)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | shared with you |
ml.logo_detect(file.message_screenshot()).brands[].name | member | Microsoft |
ml.logo_detect(file.message_screenshot()).brands[].name | member | Dropbox |
ml.logo_detect(file.message_screenshot()).brands[].name | member | Google |
ml.logo_detect(file.message_screenshot()).brands[].confidence | equals | high |
regex.icontains | regex | (optional|section|placeholder|todo|fixme) |
strings.icontains | substring | if the button does not work |
ml.nlu_classifier(body.current_thread.text).intents[].name | member | cred_theft |
ml.nlu_classifier(body.current_thread.text).intents[].name | member | bec |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | equals | high |
sender.email.email | member | no-reply@outlook.mail.microsoft |
sender.email.email | member | azuredevops@microsoft.com |