Detection rules › Sublime MQL

Sublime MQL rules: google

Rule	Severity
Google Drive abuse: Credential phishing link	`high`

Google Drive abuse: Credential phishing link

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

This rule detects legitimate Google Drive shares that link to files on Google Drive that host credential phishing content. The file is usually a PDF that impersonates a legitimate brand, with credential theft language, and a button or link to an external site that steals login credentials.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	Free file host, Impersonation: Brand

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
body.links
sender.email
type

Rule body

type.inbound
and sender.email.email in (
  "drive-shares-dm-noreply@google.com",
  "drive-shares-noreply@google.com"
)

// malicious observed shares don't include the google "Added you as an editor" phrase.
// allowing user edits to a malicous document could neuter the threat
and not strings.contains(body.current_thread.text, "added you as an editor")
and any(filter(body.links,
               .href_url.domain.domain != "support.google.com"
               and .display_text == "Open"
        ),
        (
          (
            ml.link_analysis(., mode="aggressive").credphish.disposition == "phishing"
          )
          and length(ml.logo_detect(ml.link_analysis(., mode="aggressive").screenshot
                     ).brands
          ) > 0
        )
        or any(file.explode(ml.link_analysis(.).screenshot),
               (
                 any(ml.nlu_classifier(.scan.ocr.raw).intents,
                     .name == "cred_theft" and .confidence in ("medium", "high")
                 )
                 and (
                   length(ml.logo_detect(ml.link_analysis(..).screenshot).brands
                   ) > 0
                   and ml.link_analysis(..).credphish.disposition == "phishing"
                 )
               )
               and not ml.link_analysis(..).effective_url.domain.domain == "accounts.google.com"
               // standard Google Docs error
               and not strings.contains(.scan.ocr.raw,
                                        "encountered an error. Please try reloading this page"
               )
        )
)

Detection logic

Scope: inbound message.

inbound message
sender.email.email in ('drive-shares-dm-noreply@google.com', 'drive-shares-noreply@google.com')
not:
- body.current_thread.text contains 'added you as an editor'
any of filter(body.links) where any holds:
- all of:
  - ml.link_analysis(.).credphish.disposition is 'phishing'
  - length(ml.logo_detect(ml.link_analysis(., mode='aggressive').screenshot).brands) > 0
- any of file.explode(...) where all hold:
  - all of:
    
    any of ml.nlu_classifier(.scan.ocr.raw).intents where all hold:
    
    .name is 'cred_theft'
    .confidence in ('medium', 'high')
    all of:
    
    length(ml.logo_detect(ml.link_analysis(.).screenshot).brands) > 0
    ml.link_analysis(.).credphish.disposition is 'phishing'
  - not:
    
    ml.link_analysis(.).effective_url.domain.domain is 'accounts.google.com'
  - not:
    
    .scan.ocr.raw contains 'encountered an error. Please try reloading this page'

Inspects: body.current_thread.text, body.links, body.links[].display_text, body.links[].href_url.domain.domain, sender.email.email, type.inbound. Sensors: file.explode, ml.link_analysis, ml.logo_detect, ml.nlu_classifier, strings.contains.

Indicators matched (6)

Field	Match	Value
`sender.email.email`	member	`drive-shares-dm-noreply@google.com`
`sender.email.email`	member	`drive-shares-noreply@google.com`
`body.links[].display_text`	equals	`Open`
`ml.nlu_classifier(file.explode(...)[].scan.ocr.raw).intents[].name`	equals	`cred_theft`
`ml.nlu_classifier(file.explode(...)[].scan.ocr.raw).intents[].confidence`	member	`medium`
`ml.nlu_classifier(file.explode(...)[].scan.ocr.raw).intents[].confidence`	member	`high`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(filter(body.links))
    or
      any(file.explode(...))
        and
          any(ml.nlu_classifier(file.explode(...).scan.ocr.raw).intents)
            and
              ml.nlu_classifier(file.explode(...)[].scan.ocr.raw).intents[].confidence in ["high", "medium"]
              ml.nlu_classifier(file.explode(...)[].scan.ocr.raw).intents[].name eq "cred_theft"
          not
            file.explode(...).scan.ocr.raw contains "encountered an error. Please try reloading this page"
          not
            ml.link_analysis func_call "ml.link_analysis(filter(body.links)[]).effective_url.domain.domain == accounts.google.com"
          ml.link_analysis func_call "ml.link_analysis(filter(body.links)[]).credphish.disposition == phishing"
          ml.logo_detect(ml.link_analysis(filter(body.links)[]).screenshot).brands length_compare "0"
      and
        ml.link_analysis func_call "ml.link_analysis(filter(body.links)[]).credphish.disposition == phishing"
        ml.logo_detect(ml.link_analysis(filter(body.links)[], mode='aggressive').screenshot).brands length_compare "0"
  not
    body.current_thread.text contains "added you as an editor"
  sender.email.email in ["drive-shares-dm-noreply@google.com", "drive-shares-noreply@google.com"]
  type.inbound eq "true"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`body.current_thread.text`	contains	`added you as an editor`	`excludes:body.current_thread.text` `field:"body.current_thread.text" value:"added you as an editor"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`sender.email.email`	in	`drive-shares-dm-noreply@google.com` `drive-shares-noreply@google.com`	`field:"sender.email.email" kind:in`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`