Detection rules › Sublime MQL
Credential phishing link (unknown sender)
Message contains a link to a credential phishing page from an unknown sender.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Social engineering |
Event coverage
Rule body MQL
type.inbound
and 0 < length(body.links) < 10
and any(body.links,
ml.link_analysis(.).credphish.disposition == "phishing"
and (
ml.link_analysis(.).credphish.confidence in ("medium", "high")
or ml.link_analysis(.).credphish.contains_captcha
)
and length(ml.link_analysis(.).final_dom.links) < 50
// negate legitimate use of Google reCAPTCHA embedded badge
and not (
(
ml.link_analysis(.).credphish.brand.name == "Captcha"
or ml.link_analysis(.).credphish.contains_captcha
)
and length(html.xpath(ml.link_analysis(.).final_dom,
"//div[@class='grecaptcha-badge' and @data-style='bottomright']"
).nodes
) == 1
)
)
and (
(
not profile.by_sender().solicited
and profile.by_sender().prevalence != "common"
)
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
// negate legit replies threads
and not (
(
strings.istarts_with(subject.subject, "RE:")
// out of office auto-reply
or strings.istarts_with(subject.subject, "Automatic reply:")
)
and (length(headers.references) > 0 or headers.in_reply_to is not null)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
// exclude bounce backs & read receipts
and not strings.like(sender.email.local_part,
"*postmaster*",
"*mailer-daemon*",
"*administrator*"
)
and not regex.icontains(subject.subject, "^(undeliverable|read:)")
and not any(attachments, .content_type == "message/delivery-status")
// if the "References" is in the body of the message, it's probably a bounce
and not any(headers.references, strings.contains(body.html.display_text, .))
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
Message contains a link to a credential phishing page from an unknown sender.
- inbound message
all of:
- length(body.links) > 0
- length(body.links) < 10
any of
body.linkswhere all hold:- ml.link_analysis(.).credphish.disposition is 'phishing'
any of:
- ml.link_analysis(.).credphish.confidence in ('medium', 'high')
- ml.link_analysis(.).credphish.contains_captcha
- length(ml.link_analysis(.).final_dom.links) < 50
not:
all of:
any of:
- ml.link_analysis(.).credphish.brand.name is 'Captcha'
- ml.link_analysis(.).credphish.contains_captcha
- length(html.xpath(ml.link_analysis(.).final_dom, "//div[@class='grecaptcha-badge' and @data-style='bottomright']").nodes) is 1
any of:
all of:
not:
- profile.by_sender().solicited
- profile.by_sender().prevalence is not 'common'
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
not:
all of:
any of:
- subject.subject starts with 'RE:'
- subject.subject starts with 'Automatic reply:'
any of:
- length(headers.references) > 0
- headers.in_reply_to is set
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
not:
sender.email.local_part matches any of 3 patterns
*postmaster**mailer-daemon**administrator*
not:
- subject.subject matches '^(undeliverable|read:)'
not:
any of
attachmentswhere:- .content_type is 'message/delivery-status'
not:
any of
headers.referenceswhere:- strings.contains(body.html.display_text)
not:
- profile.by_sender().any_messages_benign
Inspects: attachments[].content_type, body.html.display_text, body.links, headers.auth_summary.dmarc.pass, headers.in_reply_to, headers.references, sender.email.domain.root_domain, sender.email.local_part, subject.subject, type.inbound. Sensors: html.xpath, ml.link_analysis, profile.by_sender, regex.icontains, strings.contains, strings.istarts_with, strings.like. Reference lists: $high_trust_sender_root_domains.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
strings.istarts_with | prefix | RE: |
strings.istarts_with | prefix | Automatic reply: |
strings.like | substring | *postmaster* |
strings.like | substring | *mailer-daemon* |
strings.like | substring | *administrator* |
regex.icontains | regex | ^(undeliverable|read:) |
attachments[].content_type | equals | message/delivery-status |