Detection rules › Sublime MQL
Mismatched links: Free file share with urgent language
Detects messages from first-time senders containing free file sharing links, multiple urgent language indicators, and mismatched link text.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Callback Phishing, Credential Phishing, Extortion, Malware/Ransomware, Spam |
| Tactics and techniques | Free file host, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.current_thread |
| body.links (collection) |
| subject |
| type |
Rule body MQL
type.inbound
// Unsolicited + new sender
and (
profile.by_sender_email().prevalence in ("new", "outlier")
and not profile.by_sender_email().solicited
)
and not profile.by_sender_email().any_messages_benign
// Free file share
and any(body.links, .href_url.domain.domain in $free_file_hosts)
// urgent language
and 3 of (
any(ml.nlu_classifier(body.current_thread.text).entities, .name == "urgency"),
any(ml.nlu_classifier(subject.subject).entities, .name == "urgency"),
regex.icontains(body.current_thread.text,
'immediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested'
),
regex.icontains(subject.subject,
'immediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement'
),
regex.icontains(body.current_thread.text,
'deadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time'
)
)
// Mismatched link
and any(body.links,
.mismatched == true
and length(body.links) <= 3
and not .href_url.domain.root_domain in (
"mimecast.com",
"mimecastprotect.com"
)
)
Detection logic
Scope: inbound message.
Detects messages from first-time senders containing free file sharing links, multiple urgent language indicators, and mismatched link text.
- inbound message
all of:
- profile.by_sender_email().prevalence in ('new', 'outlier')
not:
- profile.by_sender_email().solicited
not:
- profile.by_sender_email().any_messages_benign
any of
body.linkswhere:- .href_url.domain.domain in $free_file_hosts
at least 3 of:
any of
ml.nlu_classifier(body.current_thread.text).entitieswhere:- .name is 'urgency'
any of
ml.nlu_classifier(subject.subject).entitieswhere:- .name is 'urgency'
- body.current_thread.text matches 'immediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested'
- subject.subject matches 'immediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement'
- body.current_thread.text matches 'deadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time'
any of
body.linkswhere all hold:- .mismatched is True
- length(body.links) ≤ 3
not:
- .href_url.domain.root_domain in ('mimecast.com', 'mimecastprotect.com')
Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].mismatched, subject.subject, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender_email, regex.icontains. Reference lists: $free_file_hosts.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
ml.nlu_classifier(body.current_thread.text).entities[].name | equals | urgency |
ml.nlu_classifier(subject.subject).entities[].name | equals | urgency |
regex.icontains | regex | immediate|urgent|expire|suspend|action.{0,20}required|time.{0,10}sensitive|verify.{0,20}immediately|complete.{0,20}requested |
regex.icontains | regex | immediate|urgent|expire|suspend|action.{0,20}required|important.{0,20}announcement |
regex.icontains | regex | deadline|expires?.{0,10}(today|soon)|act.{0,10}now|time.{0,10}running.{0,10}out|limited.{0,10}time |
body.links[].href_url.domain.root_domain | member | mimecast.com |
body.links[].href_url.domain.root_domain | member | mimecastprotect.com |