Detection rules › Sublime MQL
Link: Concatenated display text concealing duplicate URLs with PDF reference
Detects messages where two identical links are displayed as a single continuous text string, with the second link containing 'PDF' in its display text. This technique can be used to obscure the true nature of links by making them appear as legitimate document references.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| type |
Rule body MQL
type.inbound
and strings.contains(body.current_thread.text,
strings.concat(body.current_thread.links[0].display_text,
body.current_thread.links[1].display_text
)
)
and body.current_thread.links[0].href_url.url == body.current_thread.links[1].href_url.url
and strings.icontains(body.current_thread.links[1].display_text, 'pdf')
Detection logic
Scope: inbound message.
Detects messages where two identical links are displayed as a single continuous text string, with the second link containing 'PDF' in its display text. This technique can be used to obscure the true nature of links by making them appear as legitimate document references.
- inbound message
- strings.contains(body.current_thread.text)
- body.current_thread.links[0].href_url.url is body.current_thread.links[1].href_url.url
- body.current_thread.links[1].display_text contains 'pdf'
Inspects: body.current_thread.links[0].display_text, body.current_thread.links[0].href_url.url, body.current_thread.links[1].display_text, body.current_thread.links[1].href_url.url, body.current_thread.text, type.inbound. Sensors: strings.concat, strings.contains, strings.icontains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | pdf |