Detection rules › Sublime MQL
Sublime MQL rules: google
| Rule | Severity |
|---|---|
| Google Drive abuse: Credential phishing link | high |
Google Drive abuse: Credential phishing link
#This rule detects legitimate Google Drive shares that link to files on Google Drive that host credential phishing content. The file is usually a PDF that impersonates a legitimate brand, with credential theft language, and a button or link to an external site that steals login credentials.
Threat Classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Free file host, Impersonation: Brand |
Telemetry Coverage
| Platform | Record / event type |
|---|---|
| Sublime | Inbound email message |
Message Attributes
bodybody.current_threadbody.linkssender.emailtype
Rule Body
type.inbound
and sender.email.email in (
"drive-shares-dm-noreply@google.com",
"drive-shares-noreply@google.com"
)
// malicious observed shares don't include the google "Added you as an editor" phrase.
// allowing user edits to a malicous document could neuter the threat
and not strings.contains(body.current_thread.text, "added you as an editor")
and any(filter(body.links,
.href_url.domain.domain != "support.google.com"
and .display_text == "Open"
),
(
(
ml.link_analysis(., mode="aggressive").credphish.disposition == "phishing"
)
and length(ml.logo_detect(ml.link_analysis(., mode="aggressive").screenshot
).brands
) > 0
)
or any(file.explode(ml.link_analysis(.).screenshot),
(
any(ml.nlu_classifier(.scan.ocr.raw).intents,
.name == "cred_theft" and .confidence in ("medium", "high")
)
and (
length(ml.logo_detect(ml.link_analysis(..).screenshot).brands
) > 0
and ml.link_analysis(..).credphish.disposition == "phishing"
)
)
and not ml.link_analysis(..).effective_url.domain.domain == "accounts.google.com"
// standard Google Docs error
and not strings.contains(.scan.ocr.raw,
"encountered an error. Please try reloading this page"
)
)
)
Detection Logic
Scope: inbound message.
This rule detects legitimate Google Drive shares that link to files on Google Drive that host credential phishing content. The file is usually a PDF that impersonates a legitimate brand, with credential theft language, and a button or link to an external site that steals login credentials.
- inbound message
- sender.email.email in ('drive-shares-dm-noreply@google.com', 'drive-shares-noreply@google.com')
not:
- body.current_thread.text contains 'added you as an editor'
- any(filter(body.links, .href_url.domain.domain != "support.google.com" and .display_text == "Open" ), ( ( ml.link_analysis(., mode="aggressive").credphish.disposition == "phishing" ) and length(ml.logo_detect(ml.link_analysis(., mode="aggressive").screenshot ).brands ) > 0 ) or any(file.explode(ml.link_analysis(.).screenshot), ( any(ml.nlu_classifier(.scan.ocr.raw).intents, .name == "cred_theft" and .confidence in ("medium", "high") ) and ( length(ml.logo_detect(ml.link_analysis(..).screenshot).brands ) > 0 and ml.link_analysis(..).credphish.disposition == "phishing" ) ) and not ml.link_analysis(..).effective_url.domain.domain == "accounts.google.com" // standard Google Docs error and not strings.contains(.scan.ocr.raw, "encountered an error. Please try reloading this page" ) ) )
Inspects: body.current_thread.text, body.links, body.links[].display_text, body.links[].href_url.domain.domain, sender.email.email, type.inbound. Sensors: file.explode, ml.link_analysis, ml.logo_detect, ml.nlu_classifier, strings.contains.
Indicators Matched (6)
| Field | Match | Value |
|---|---|---|
sender.email.email | member | drive-shares-dm-noreply@google.com |
sender.email.email | member | drive-shares-noreply@google.com |
body.links[].display_text | equals | Open |
ml.nlu_classifier(file.explode(...)[].scan.ocr.raw).intents[].name | equals | cred_theft |
ml.nlu_classifier(file.explode(...)[].scan.ocr.raw).intents[].confidence | member | medium |
ml.nlu_classifier(file.explode(...)[].scan.ocr.raw).intents[].confidence | member | high |
Stages and Predicates
Stage 1: mql_rule
and
not
body.current_thread.text contains "added you as an editor"
sender.email.email in ["drive-shares-dm-noreply@google.com", "drive-shares-noreply@google.com"]
type.inbound eq "true"
macro "any(filter(body.links,\n .href_url.domain.domain != \"support.google.com\"\n and .display_text == \"Open\"\n ),\n (\n (\n ml.link_analysis(., mode=\"aggressive\").credphish.disposition == \"phishing\"\n )\n and length(ml.logo_detect(ml.link_analysis(., mode=\"aggressive\").screenshot\n ).brands\n ) > 0\n )\n or any(file.explode(ml.link_analysis(.).screenshot),\n (\n any(ml.nlu_classifier(.scan.ocr.raw).intents,\n .name == \"cred_theft\" and .confidence in (\"medium\", \"high\")\n )\n and (\n length(ml.logo_detect(ml.link_analysis(..).screenshot).brands\n ) > 0\n and ml.link_analysis(..).credphish.disposition == \"phishing\"\n )\n )\n and not ml.link_analysis(..).effective_url.domain.domain == \"accounts.google.com\"\n // standard Google Docs error\n and not strings.contains(.scan.ocr.raw,\n \"encountered an error. Please try reloading this page\"\n )\n )\n)"Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
sender.email.email | in |
| field:"sender.email.email" kind:in |
type.inbound | eq |
| field:"type.inbound" kind:eq value:"true" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
body.current_thread.text | contains | added you as an editor | excludes:body.current_thread.text field:"body.current_thread.text" value:"added you as an editor" |