Detection rules › Sublime MQL

Sublime MQL rules: image

Rule	Severity
Image as content with a link to an open redirect	`high`

Image as content with a link to an open redirect

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Body contains little, no, or only disclaimer text, an image, and a link to an open redirect.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing, Malware/Ransomware
Tactics and techniques	Evasion, Image as content, Open redirect, Social engineering

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

attachments
body
body.current_thread
body.html
body.links
headers
headers.auth_summary
sender.email
type

Rule body

type.inbound
and length(body.links) < 3
and 0 < (length(attachments)) < 3
and all(attachments, (.file_type in $file_types_images))
and all(attachments, (.size > 10000))
// image is in body
and strings.icontains(body.html.raw, 'src="cid')
// sender domain matches no body domains
and all(body.links,
        .href_url.domain.root_domain != sender.email.domain.root_domain
)
and (
  // body text is very short
  (
    0 <= (length(body.current_thread.text)) < 10
    or body.current_thread.text is null
  )
  or (
    length(body.current_thread.text) < 900
    // or body is most likely all warning banner (text contains the sender and common warning banner language)
    and (
      (
        strings.contains(body.current_thread.text, sender.email.email)
        and strings.contains(body.current_thread.text, 'caution')
      )
      or regex.icontains(body.current_thread.text,
                         "intended recipient's use only|external email|sent from outside|you don't often|confidential"
      )
    )
  )
)
and (
  any(body.links,
      any(.href_url.rewrite.encoders, strings.icontains(., "open_redirect"))
      and .href_url.domain.root_domain not in $high_trust_sender_root_domains
  )
  or any(body.links,
         .href_url.domain.root_domain == 'sng.link'
         and strings.ilike(.href_url.query_params, "*fallback_redirect*")
  )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Body contains little, no, or only disclaimer text, an image, and a link to an open redirect.

inbound message
length(body.links) < 3
all of:
- length(attachments) > 0
- length(attachments) < 3
all of attachments where:
- .file_type in $file_types_images
all of attachments where:
- .size > 10000
body.html.raw contains 'src="cid'
all of body.links where:
- .href_url.domain.root_domain is not sender.email.domain.root_domain
any of:
- any of:
  - all of:
    
    length(body.current_thread.text) ≥ 0
    length(body.current_thread.text) < 10
  - body.current_thread.text is missing
- all of:
  - length(body.current_thread.text) < 900
  - any of:
    
    all of:
    
    strings.contains(body.current_thread.text)
    body.current_thread.text contains 'caution'
    body.current_thread.text matches "intended recipient's use only|external email|sent from outside|you don't often|confidential"
any of:
- any of body.links where all hold:
  - any of .href_url.rewrite.encoders where:
    
    . contains 'open_redirect'
  - .href_url.domain.root_domain not in $high_trust_sender_root_domains
- any of body.links where all hold:
  - .href_url.domain.root_domain is 'sng.link'
  - .href_url.query_params matches '*fallback_redirect*'
any of:
- all of:
  - sender.email.domain.root_domain in $high_trust_sender_root_domains
  - not:
    
    headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: attachments[].file_type, attachments[].size, body.current_thread.text, body.html.raw, body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.query_params, body.links[].href_url.rewrite.encoders, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: regex.icontains, strings.contains, strings.icontains, strings.ilike. Reference lists: $file_types_images, $high_trust_sender_root_domains.

Indicators matched (6)

Field	Match	Value
`strings.icontains`	substring	`src="cid`
`strings.contains`	substring	`caution`
`regex.icontains`	regex	`intended recipient's use only\|external email\|sent from outside\|you don't often\|confidential`
`strings.icontains`	substring	`open_redirect`
`body.links[].href_url.domain.root_domain`	equals	`sng.link`
`strings.ilike`	substring	`fallback_redirect`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    and
      or
        and
          body.current_thread.text contains "caution"
          strings.contains func_call "strings.contains(body.current_thread.text)"
        body.current_thread.text regex_match "intended recipient's use only|external email|sent from outside|you don't often|confidential"
      body.current_thread.text length_compare "900"
    and
      body.current_thread.text length_compare "0"
      body.current_thread.text length_compare "10"
    body.current_thread.text is_null
  or
    any(body.links)
      and
        any(body.links.href_url.rewrite.encoders)
          body.links.href_url.rewrite.encoders contains "open_redirect"
         macro "body.links[].href_url.domain.root_domain not in high_trust_sender_root_domains"
    any(body.links)
      and
        body.links.href_url.domain.root_domain eq "sng.link"
        body.links.href_url.query_params match "fallback_redirect"
  or
    and
      not
        headers.auth_summary.dmarc.pass eq "true"
       macro "sender.email.domain.root_domain in high_trust_sender_root_domains"
     macro "sender.email.domain.root_domain not in high_trust_sender_root_domains"
  attachments length_compare "0"
  attachments length_compare "3"
  body.html.raw contains "src=\"cid"
  body.links length_compare "3"
  type.inbound eq "true"
   macro "all(attachments)"
   macro "all(body.links)"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`body.current_thread.text`	contains	`caution`	`field:"body.current_thread.text" kind:contains value:"caution"`
`body.current_thread.text`	is_null	(no value, null check)	`field:"body.current_thread.text" kind:is_null`
`body.current_thread.text`	regex_match	`intended recipient's use only` `external email` `sent from outside` `you don't often` `confidential`	`field:"body.current_thread.text" kind:regex_match`
`body.html.raw`	contains	`src="cid`	`field:"body.html.raw" kind:contains`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`