Detection rules › Sublime MQL
Link: Blogspot hosting explicit romance content
Detects inbound messages containing links to Blogspot domains that host explicit romance content, identified through natural language processing of the message body.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
| Tactics and techniques | Free subdomain host, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.current_thread |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and any(body.links, .href_url.domain.root_domain == "blogspot.com")
and (
any(ml.nlu_classifier(body.current_thread.text).topics,
.name == "Sexually Explicit Messages"
)
)
Detection logic
Scope: inbound message.
Detects inbound messages containing links to Blogspot domains that host explicit romance content, identified through natural language processing of the message body.
- inbound message
any of
body.linkswhere:- .href_url.domain.root_domain is 'blogspot.com'
any of
ml.nlu_classifier(body.current_thread.text).topicswhere:- .name is 'Sexually Explicit Messages'
Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | blogspot.com |
ml.nlu_classifier(body.current_thread.text).topics[].name | equals | Sexually Explicit Messages |