Detection rules › Sublime MQL

Brand impersonation: File sharing notification with template artifacts

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages impersonating file sharing services that contain template artifacts such as placeholder comments, incomplete HTML elements, and development remnants. The message includes 'shared with you' language and exhibits multiple indicators of being generated from a malicious template including HTML comments with development terms, broken anchor tags, and filename elements that closely match the subject line.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Social engineering, Evasion

Event coverage

Rule body MQL

type.inbound
and strings.icontains(body.current_thread.text, 'shared with you')
// we detect a file sharing logo with high confidence
and any(ml.logo_detect(file.message_screenshot()).brands,
        .name in ('Microsoft', 'Dropbox', 'Google') and .confidence == "high"
)
and 2 of (
  // the subject is very similar to the name of the file-name html class
  any(html.xpath(body.html, '//span[@class="file-name"]').nodes,
      strings.ilevenshtein(.display_text, subject.subject) < 15
  ),
  // we detect a href to a # implying a neglected placeholder
  any(html.xpath(body.html, '//a[@href="#"]').nodes, .raw is not null),
  // we detect "ai-esque" comments
  any(html.xpath(body.html, '//comment()').nodes,
      regex.icontains(.raw, '(optional|section|placeholder|todo|fixme)')
  ),
  // recipients local part is in the body of the message
  any(recipients.to,
      strings.icontains(body.current_thread.text, .email.local_part)
  ),
  strings.icontains(body.html.raw, 'if the button does not work')
)
// and cred theft/bec high confidence
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name in ("cred_theft", "bec") and .confidence == "high"
)
// not sent from legitimate Microsoft emails as long as auth passes
and not (
  sender.email.email in (
    'no-reply@outlook.mail.microsoft',
    'azuredevops@microsoft.com'
  )
  and headers.auth_summary.dmarc.pass
)

Detection logic

Scope: inbound message.

Detects messages impersonating file sharing services that contain template artifacts such as placeholder comments, incomplete HTML elements, and development remnants. The message includes 'shared with you' language and exhibits multiple indicators of being generated from a malicious template including HTML comments with development terms, broken anchor tags, and filename elements that closely match the subject line.

  1. inbound message
  2. body.current_thread.text contains 'shared with you'
  3. any of ml.logo_detect(file.message_screenshot()).brands where all hold:
    • .name in ('Microsoft', 'Dropbox', 'Google')
    • .confidence is 'high'
  4. at least 2 of:
    • any of html.xpath(body.html, '//span[@class="file-name"]').nodes where:
      • strings.ilevenshtein(.display_text) < 15
    • any of html.xpath(body.html, '//a[@href="#"]').nodes where:
      • .raw is set
    • any of html.xpath(body.html, '//comment()').nodes where:
      • .raw matches '(optional|section|placeholder|todo|fixme)'
    • any of recipients.to where:
      • strings.icontains(body.current_thread.text)
    • body.html.raw contains 'if the button does not work'
  5. any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
    • .name in ('cred_theft', 'bec')
    • .confidence is 'high'
  6. not:
    • all of:
      • sender.email.email in ('no-reply@outlook.mail.microsoft', 'azuredevops@microsoft.com')
      • headers.auth_summary.dmarc.pass

Inspects: body.current_thread.text, body.html, body.html.raw, headers.auth_summary.dmarc.pass, recipients.to, recipients.to[].email.local_part, sender.email.email, subject.subject, type.inbound. Sensors: file.message_screenshot, html.xpath, ml.logo_detect, ml.nlu_classifier, regex.icontains, strings.icontains, strings.ilevenshtein.

Indicators matched (12)

FieldMatchValue
strings.icontainssubstringshared with you
ml.logo_detect(file.message_screenshot()).brands[].namememberMicrosoft
ml.logo_detect(file.message_screenshot()).brands[].namememberDropbox
ml.logo_detect(file.message_screenshot()).brands[].namememberGoogle
ml.logo_detect(file.message_screenshot()).brands[].confidenceequalshigh
regex.icontainsregex(optional|section|placeholder|todo|fixme)
strings.icontainssubstringif the button does not work
ml.nlu_classifier(body.current_thread.text).intents[].namemembercred_theft
ml.nlu_classifier(body.current_thread.text).intents[].namememberbec
ml.nlu_classifier(body.current_thread.text).intents[].confidenceequalshigh
sender.email.emailmemberno-reply@outlook.mail.microsoft
sender.email.emailmemberazuredevops@microsoft.com