Detection rules › Sublime MQL

Sublime MQL rules: issuu

Rule	Severity
Issuu document with suspicious embedded link	`high`

Issuu document with suspicious embedded link

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects when an Issuu document contains suspicious links or text, where the document is set to open in full screen mode. The rule analyzes both embedded links and document content for malicious indicators, particularly focusing on suspicious top-level domains and language patterns.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	Social engineering, Free file host, Evasion

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.links
type

Rule Body

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "issuu.com"
        and .href_url.query_params == "fr=xKAE9_zU1NQ" // opens the document full screen
        // suspicious link in the Issuu document
        and (
          any(filter(ml.link_analysis(., mode="aggressive").additional_responses,
                     strings.icontains(.url.path, "/links/")
              ),
              // less than 3 links in the Issuu document
              length(.json["1"]) < 3
              and any(.json["1"],
                      strings.parse_url(.["url"]).domain.tld in $suspicious_tlds
                      or strings.parse_url(.["url"]).domain.domain in $free_subdomain_hosts
                      or strings.parse_url(.["url"]).domain.root_domain in $free_subdomain_hosts
                      or ml.link_analysis(strings.parse_url(.["url"])).credphish.disposition == "phishing"
              )
          )
          // or, credential phishing language on the page
          or any(ml.nlu_classifier(beta.ocr(ml.link_analysis(.,
                                                             mode="aggressive"
                                            ).screenshot
                                   ).text
                 ).intents,
                 .name == "cred_theft" and .confidence != "low"
          )
        )
)
and not profile.by_sender_email().any_messages_benign

Detection Logic

Scope: inbound message.

inbound message
any of body.links where all hold:
- .href_url.domain.root_domain is 'issuu.com'
- .href_url.query_params is 'fr=xKAE9_zU1NQ'
- any of:
  - any(filter(ml.link_analysis(., mode="aggressive").additional_responses, strings.icontains(.url.path, "/links/") ), // less than 3 links in the Issuu document length(.json["1"]) < 3 and any(.json["1"], strings.parse_url(.["url"]).domain.tld in $suspicious_tlds or strings.parse_url(.["url"]).domain.domain in $free_subdomain_hosts or strings.parse_url(.["url"]).domain.root_domain in $free_subdomain_hosts or ml.link_analysis(strings.parse_url(.["url"])).credphish.disposition == "phishing" ) )
  - any(ml.nlu_classifier(beta.ocr(ml.link_analysis(., mode="aggressive" ).screenshot ).text ).intents, .name == "cred_theft" and .confidence != "low" )
not:
- profile.by_sender_email().any_messages_benign

Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.query_params, type.inbound. Sensors: beta.ocr, ml.link_analysis, ml.nlu_classifier, profile.by_sender_email, strings.icontains, strings.parse_url. Reference lists: $free_subdomain_hosts, $suspicious_tlds.

Indicators Matched (4)

Field	Match	Value
`body.links[].href_url.domain.root_domain`	equals	`issuu.com`
`body.links[].href_url.query_params`	equals	`fr=xKAE9_zU1NQ`
`strings.icontains`	substring	`/links/`
`ml.nlu_classifier(beta.ocr(ml.link_analysis(body.links[], mode='aggressive').screenshot).text).intents[].name`	equals	`cred_theft`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(body.links)
    and
      or
         macro "any(filter(ml.link_analysis(., mode=\"aggressive\").additional_responses,\n                     strings.icontains(.url.path, \"/links/\")\n              ),\n              // less than 3 links in the Issuu document\n              length(.json[\"1\"]) < 3\n              and any(.json[\"1\"],\n                      strings.parse_url(.[\"url\"]).domain.tld in $suspicious_tlds\n                      or strings.parse_url(.[\"url\"]).domain.domain in $free_subdomain_hosts\n                      or strings.parse_url(.[\"url\"]).domain.root_domain in $free_subdomain_hosts\n                      or ml.link_analysis(strings.parse_url(.[\"url\"])).credphish.disposition == \"phishing\"\n              )\n          )"
         macro "any(ml.nlu_classifier(beta.ocr(ml.link_analysis(.,\n                                                             mode=\"aggressive\"\n                                            ).screenshot\n                                   ).text\n                 ).intents,\n                 .name == \"cred_theft\" and .confidence != \"low\"\n          )"
      body.links.href_url.domain.root_domain eq "issuu.com"
      body.links.href_url.query_params eq "fr=xKAE9_zU1NQ"
  not
    profile.by_sender_email func_call "profile.by_sender_email().any_messages_benign"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean` corpus 1212 (mql 1212)	`field:"type.inbound" kind:eq value:"true"`

Back to all Sublime MQL rules