Detection rules › Sublime MQL
Link: chatbot.page platform abuse
Detects abuse of chatbot.page where configurations suggest malicious intent, including incomplete contact information, free-tier usage, and suspicious question content.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Social engineering, Out of band pivot |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and length(filter(body.links, .href_url.domain.domain == "chatbot.page")) == 1
and any(body.links,
.href_url.domain.domain == "chatbot.page"
// pull out the <script> block that contains the JSON
and (
any(html.xpath(ml.link_analysis(.).final_dom,
'//script[contains(text(), "window.form")]'
).nodes,
// parse out the JSON
any(regex.extract(.raw, 'window.form = (?P<json>{.*})'),
// user didn't fill out any contact info, indicative of abuse
// a legitimate business would complete this information
strings.parse_json(.named_groups['json'])['emailSignature']['name'] == 'John Doe'
// a legitimate business would likely not be on the free plan
or strings.parse_json(.named_groups['json'])['config']['userPlan'] == 'free'
or (
// only 1 question
length(strings.parse_json(.named_groups['json'])['questions']
) == 1
// pull out the link(s) in the question
and any(strings.parse_json(.named_groups['json'])['questions'],
any(.['links'],
// NLU on link display text
any(ml.nlu_classifier(.['text']).intents,
.name == "cred_theft"
)
// LA on the link itself
or ml.link_analysis(strings.parse_url(.['value']
),
mode="aggressive"
).credphish.disposition == "phishing"
)
)
)
)
)
or strings.icontains(ml.link_analysis(.).final_dom.display_text,
"This chatbot has been blocked by the administrator"
)
)
)
Detection logic
Scope: inbound message.
Detects abuse of chatbot.page where configurations suggest malicious intent, including incomplete contact information, free-tier usage, and suspicious question content.
- inbound message
- length(filter(body.links, .href_url.domain.domain == 'chatbot.page')) is 1
any of
body.linkswhere all hold:- .href_url.domain.domain is 'chatbot.page'
any of:
any of
html.xpath(ml.link_analysis(.).final_dom, '//script[contains(text(), "window.form")]').nodeswhere:any of
regex.extract(.raw)where any holds:- strings.parse_json(.named_groups['json']).['emailSignature']['name'] is 'John Doe'
- strings.parse_json(.named_groups['json']).['config']['userPlan'] is 'free'
all of:
- length(strings.parse_json(.named_groups['json'])['questions']) is 1
any of
strings.parse_json(.named_groups['json'])['questions']where:any of
.['links']where any holds:any of
ml.nlu_classifier(.['text']).intentswhere:- .name is 'cred_theft'
- ml.link_analysis(strings.parse_url(.['value'])).credphish.disposition is 'phishing'
- ml.link_analysis(.).final_dom.display_text contains 'This chatbot has been blocked by the administrator'
Inspects: body.links, body.links[].href_url.domain.domain, type.inbound. Sensors: html.xpath, ml.link_analysis, ml.nlu_classifier, regex.extract, strings.icontains, strings.parse_json, strings.parse_url.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.domain | equals | chatbot.page |
regex.extract | regex | window.form = (?P<json>{.*}) |
ml.nlu_classifier(strings.parse_json(regex.extract(html.xpath(ml.link_analysis(body.links[]).final_dom, '//script[contains(text(), "window.form")]').nodes[].raw)[].named_groups['json'])['questions'][]['links'][]['text']).intents[].name | equals | cred_theft |
strings.icontains | substring | This chatbot has been blocked by the administrator |