Detection rules › Sublime MQL
Link: URL shortener with copy-paste instructions and credential theft language
Detects messages containing only URL shorteners with copy-paste instructions and high-confidence credential theft language, typically used to evade URL analysis by requiring manual URL entry.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
Rule body MQL
type.inbound
and length(body.current_thread.links) > 0
and all(body.current_thread.links,
.href_url.domain.root_domain in $url_shorteners
)
and (
strings.icontains(body.current_thread.text, 'copy')
and (
strings.icontains(body.current_thread.text, 'pasting')
or strings.icontains(body.current_thread.text, 'paste')
)
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == 'cred_theft' and .confidence == 'high'
)
and (
// self sender
(
length(recipients.to) == 1
and sender.email.email == recipients.to[0].email.email
)
// or the sender is all undisclosed or there is no recipients
or (
length(recipients.to) == 0
or all(recipients.to, .email.domain.valid == false)
)
)
// negate display urls that match the sender root domain
and not any(body.current_thread.links,
.display_url.domain.root_domain == sender.email.domain.root_domain
)
Detection logic
Scope: inbound message.
Detects messages containing only URL shorteners with copy-paste instructions and high-confidence credential theft language, typically used to evade URL analysis by requiring manual URL entry.
- inbound message
- length(body.current_thread.links) > 0
all of
body.current_thread.linkswhere:- .href_url.domain.root_domain in $url_shorteners
all of:
- body.current_thread.text contains 'copy'
any of:
- body.current_thread.text contains 'pasting'
- body.current_thread.text contains 'paste'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'cred_theft'
- .confidence is 'high'
any of:
all of:
- length(recipients.to) is 1
- sender.email.email is recipients.to[0].email.email
any of:
- length(recipients.to) is 0
all of
recipients.towhere:- .email.domain.valid is False
not:
any of
body.current_thread.linkswhere:- .display_url.domain.root_domain is sender.email.domain.root_domain
Inspects: body.current_thread.links, body.current_thread.links[].display_url.domain.root_domain, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.text, recipients.to, recipients.to[0].email.email, recipients.to[].email.domain.valid, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: ml.nlu_classifier, strings.icontains. Reference lists: $url_shorteners.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | copy |
strings.icontains | substring | pasting |
strings.icontains | substring | paste |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | cred_theft |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | equals | high |