detection.wiki

Detection rules › Sublime MQL

Sublime MQL rules: free

RuleSeverity
Link: Free file host link with 'Important Viewing Note' luremedium
Mismatched links: Free file share with urgent languagemedium

Link: Free file host link with 'Important Viewing Note' lure

#
Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages containing links to free file hosting domains paired with the phrase 'important viewing note' in the message body. These messages often masquerade as institutional or educational communications — such as student conduct reports or advancement initiatives — to add legitimacy and encourage recipients to follow the hosted link.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesFree file host, Social engineering, Impersonation: Brand

Telemetry Coverage

PlatformRecord / event type
SublimeInbound email message

Message Attributes

  • body
  • body.current_thread
  • type

Rule Body

type.inbound
and any(body.current_thread.links, .href_url.domain.domain in $free_file_hosts)
and strings.icontains(body.current_thread.text, 'important viewing note')

Detection Logic

Scope: inbound message.

Detects inbound messages containing links to free file hosting domains paired with the phrase 'important viewing note' in the message body. These messages often masquerade as institutional or educational communications — such as student conduct reports or advancement initiatives — to add legitimacy and encourage recipients to follow the hosted link.

  1. inbound message
  2. any of body.current_thread.links where:
    • .href_url.domain.domain in $free_file_hosts
  3. body.current_thread.text contains 'important viewing note'

Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.domain, body.current_thread.text, type.inbound. Sensors: strings.icontains. Reference lists: $free_file_hosts.

Indicators Matched (1)

FieldMatchValue
strings.icontainssubstringimportant viewing note

Stages and Predicates

Stage 1: mql_rule

and
  any(body.current_thread.links)
    body.current_thread.links.href_url.domain.domain macro "body.current_thread.links[].href_url.domain.domain in free_file_hosts"
  body.current_thread.text contains "important viewing note"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
body.current_thread.textcontains
  • important viewing note
field:"body.current_thread.text" kind:contains value:"important viewing note"
type.inboundeq
  • true transforms: boolean corpus 1212 (mql 1212)
field:"type.inbound" kind:eq value:"true"

Mismatched links: Free file share with urgent language

#
Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages from first-time senders containing free file sharing links, multiple urgent language indicators, and mismatched link text.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Callback Phishing, Credential Phishing, Extortion, Malware/Ransomware, Spam
Tactics and techniquesFree file host, Social engineering

Telemetry Coverage

PlatformRecord / event type
SublimeInbound email message

Message Attributes

  • body
  • body.current_thread
  • body.links
  • subject
  • type

Rule Body

type.inbound

// Unsolicited + new sender
and (
  profile.by_sender_email().prevalence in ("new", "outlier")
  and not profile.by_sender_email().solicited
)
and not profile.by_sender_email().any_messages_benign

// Free file share
and any(body.links, .href_url.domain.domain in $free_file_hosts)

// urgent language
and 3 of (
  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "urgency"),
  any(ml.nlu_classifier(subject.subject).entities, .name == "urgency"),
  regex.icontains(body.current_thread.text,
                  'immediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested'
  ),
  regex.icontains(subject.subject,
                  'immediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement'
  ),
  regex.icontains(body.current_thread.text,
                  'deadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time'
  )
)

// Mismatched link
and any(body.links,
        .mismatched == true
        and length(body.links) <= 3
        and not .href_url.domain.root_domain in (
          "mimecast.com",
          "mimecastprotect.com"
        )
)

Detection Logic

Scope: inbound message.

Detects messages from first-time senders containing free file sharing links, multiple urgent language indicators, and mismatched link text.

  1. inbound message
  2. all of:
    • profile.by_sender_email().prevalence in ("new", "outlier")
    • not:
      • profile.by_sender_email().solicited
  3. not:
    • profile.by_sender_email().any_messages_benign
  4. any of body.links where:
    • .href_url.domain.domain in $free_file_hosts
  5. at least 3 of:
    • any(ml.nlu_classifier(body.current_thread.text).entities, .name == "urgency")
    • any(ml.nlu_classifier(subject.subject).entities, .name == "urgency")
    • body.current_thread.text matches 'immediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested'
    • subject.subject matches 'immediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement'
    • body.current_thread.text matches 'deadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time'
  6. any of body.links where all hold:
    • .mismatched is True
    • length(body.links) <= 3
    • not:
      • .href_url.domain.root_domain in ('mimecast.com', 'mimecastprotect.com')

Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].mismatched, subject.subject, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender_email, regex.icontains. Reference lists: $free_file_hosts.

Indicators Matched (5)

FieldMatchValue
ml.nlu_classifier(body.current_thread.text).entities[].nameequalsurgency
ml.nlu_classifier(subject.subject).entities[].nameequalsurgency
regex.icontainsregeximmediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested
regex.icontainsregeximmediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement
regex.icontainsregexdeadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time

Stages and Predicates

Stage 1: mql_rule

and
  any(body.links)
    and
      not
        body.links.href_url.domain.root_domain in ["mimecast.com", "mimecastprotect.com"]
      body.links length_compare "3"
      body.links.mismatched eq "true"
  or
    and
      body.current_thread.text regex_match "deadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time"
      body.current_thread.text regex_match "immediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested"
      subject.subject regex_match "immediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement"
    and
      body.current_thread.text regex_match "deadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time"
      body.current_thread.text regex_match "immediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested"
       macro "any(ml.nlu_classifier(body.current_thread.text).entities, .name == \"urgency\")"
    and
      body.current_thread.text regex_match "deadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time"
      body.current_thread.text regex_match "immediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested"
       macro "any(ml.nlu_classifier(subject.subject).entities, .name == \"urgency\")"
    and
      body.current_thread.text regex_match "deadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time"
      subject.subject regex_match "immediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement"
       macro "any(ml.nlu_classifier(body.current_thread.text).entities, .name == \"urgency\")"
    and
      body.current_thread.text regex_match "deadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time"
      subject.subject regex_match "immediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement"
       macro "any(ml.nlu_classifier(subject.subject).entities, .name == \"urgency\")"
    and
      body.current_thread.text regex_match "deadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time"
       macro "any(ml.nlu_classifier(body.current_thread.text).entities, .name == \"urgency\")"
       macro "any(ml.nlu_classifier(subject.subject).entities, .name == \"urgency\")"
    and
      body.current_thread.text regex_match "immediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested"
      subject.subject regex_match "immediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement"
       macro "any(ml.nlu_classifier(body.current_thread.text).entities, .name == \"urgency\")"
    and
      body.current_thread.text regex_match "immediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested"
      subject.subject regex_match "immediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement"
       macro "any(ml.nlu_classifier(subject.subject).entities, .name == \"urgency\")"
    and
      body.current_thread.text regex_match "immediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested"
       macro "any(ml.nlu_classifier(body.current_thread.text).entities, .name == \"urgency\")"
       macro "any(ml.nlu_classifier(subject.subject).entities, .name == \"urgency\")"
    and
      subject.subject regex_match "immediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement"
       macro "any(ml.nlu_classifier(body.current_thread.text).entities, .name == \"urgency\")"
       macro "any(ml.nlu_classifier(subject.subject).entities, .name == \"urgency\")"
  any(body.links)
    body.links.href_url.domain.domain macro "body.links[].href_url.domain.domain in free_file_hosts"
  not
    profile.by_sender_email func_call "profile.by_sender_email().any_messages_benign"
  not
    profile.by_sender_email func_call "profile.by_sender_email().solicited"
  profile.by_sender_email func_call "profile.by_sender_email().prevalence in (\"new\", \"outlier\")"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
body.current_thread.textregex_match
    • deadline
    • expires?.{0,10}(today|soon)
    • act.{0,10}now
    • time.{0,10}running.{0,10}out
    • limited.{0,10}time
    • immediate
    • urgent
    • expire
    • suspend
    • action.{0,20}required
    • time.{0,10}sensitive
    • verify.{0,20}immediately
    • complete.{0,20}requested
field:"body.current_thread.text" kind:regex_match
subject.subjectregex_match
    • immediate
    • urgent
    • expire
    • suspend
    • action.{0,20}required
    • important.{0,20}announcement
field:"subject.subject" kind:regex_match
type.inboundeq
  • true transforms: boolean corpus 1212 (mql 1212)
field:"type.inbound" kind:eq value:"true"

Back to all Sublime MQL rules