detection.wiki

Detection rules › Sublime MQL

Image as content with a link to an open redirect

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Body contains little, no, or only disclaimer text, an image, and a link to an open redirect.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesEvasion, Image as content, Open redirect, Social engineering

Event coverage

Message attribute
attachments (collection)
body
body.current_thread
body.html
body.links (collection)
headers.auth_summary
sender.email
type

Rule body MQL

type.inbound
and length(body.links) < 3
and 0 < (length(attachments)) < 3
and all(attachments, (.file_type in $file_types_images))
and all(attachments, (.size > 10000))
// image is in body
and strings.icontains(body.html.raw, 'src="cid')
// sender domain matches no body domains
and all(body.links,
        .href_url.domain.root_domain != sender.email.domain.root_domain
)
and (
  // body text is very short
  (
    0 <= (length(body.current_thread.text)) < 10
    or body.current_thread.text is null
  )
  or (
    length(body.current_thread.text) < 900
    // or body is most likely all warning banner (text contains the sender and common warning banner language)
    and (
      (
        strings.contains(body.current_thread.text, sender.email.email)
        and strings.contains(body.current_thread.text, 'caution')
      )
      or regex.icontains(body.current_thread.text,
                         "intended recipient's use only|external email|sent from outside|you don't often|confidential"
      )
    )
  )
)
and (
  any(body.links,
      any(.href_url.rewrite.encoders, strings.icontains(., "open_redirect"))
      and .href_url.domain.root_domain not in $high_trust_sender_root_domains
  )
  or any(body.links,
         .href_url.domain.root_domain == 'sng.link'
         and strings.ilike(.href_url.query_params, "*fallback_redirect*")
  )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

Body contains little, no, or only disclaimer text, an image, and a link to an open redirect.

  1. inbound message
  2. length(body.links) < 3
  3. all of:
    • length(attachments) > 0
    • length(attachments) < 3
  4. all of attachments where:
    • .file_type in $file_types_images
  5. all of attachments where:
    • .size > 10000
  6. body.html.raw contains 'src="cid'
  7. all of body.links where:
    • .href_url.domain.root_domain is not sender.email.domain.root_domain
  8. any of:
    • any of:
      • all of:
        • length(body.current_thread.text) ≥ 0
        • length(body.current_thread.text) < 10
      • body.current_thread.text is missing
    • all of:
      • length(body.current_thread.text) < 900
      • any of:
        • all of:
          • strings.contains(body.current_thread.text)
          • body.current_thread.text contains 'caution'
        • body.current_thread.text matches "intended recipient's use only|external email|sent from outside|you don't often|confidential"
  9. any of:
    • any of body.links where all hold:
      • any of .href_url.rewrite.encoders where:
        • . contains 'open_redirect'
      • .href_url.domain.root_domain not in $high_trust_sender_root_domains
    • any of body.links where all hold:
      • .href_url.domain.root_domain is 'sng.link'
      • .href_url.query_params matches '*fallback_redirect*'
  10. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: attachments[].file_type, attachments[].size, body.current_thread.text, body.html.raw, body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.query_params, body.links[].href_url.rewrite.encoders, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: regex.icontains, strings.contains, strings.icontains, strings.ilike. Reference lists: $file_types_images, $high_trust_sender_root_domains.

Indicators matched (6)

FieldMatchValue
strings.icontainssubstringsrc="cid
strings.containssubstringcaution
regex.icontainsregexintended recipient's use only|external email|sent from outside|you don't often|confidential
strings.icontainssubstringopen_redirect
body.links[].href_url.domain.root_domainequalssng.link
strings.ilikesubstring*fallback_redirect*