Detection rules › Sublime MQL
Link: Unsolicited email contains link leading to Tycoon URL structure
Detects unsolicited messages containing links leading to specific tycoon URL patterns that include encoded email addresses or base64-encoded content in the path structure.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| recipients |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and 0 < length(body.links) < 15
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(body.links,
// single path
strings.count(ml.link_analysis(., mode="aggressive").effective_url.path,
'/'
) == 2
// tycoon url struct
and regex.icontains(ml.link_analysis(., mode="aggressive").effective_url.path,
'\/.*[!@].*\/[$*](?:[a-zA-Z0-9.\-_]+(?:@|%40)[a-zA-Z0-9.-]+\.[a-zA-Z]{2,3}|(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})|$)'
)
)
Detection logic
Scope: inbound message.
Detects unsolicited messages containing links leading to specific tycoon URL patterns that include encoded email addresses or base64-encoded content in the path structure.
- inbound message
all of:
- length(body.links) > 0
- length(body.links) < 15
- length(recipients.to) is 1
- recipients.to[0].email.domain.valid
any of
body.linkswhere all hold:- strings.count(ml.link_analysis(., mode='aggressive').effective_url.path, '/') is 2
- ml.link_analysis(., mode='aggressive').effective_url.path matches '\\/.*[!@].*\\/[$*](?:[a-zA-Z0-9.\\-_]+(?:@|%40)[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,3}|(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})|$)'
Inspects: body.links, recipients.to, recipients.to[0].email.domain.valid, type.inbound. Sensors: ml.link_analysis, regex.icontains, strings.count.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | \/.*[!@].*\/[$*](?:[a-zA-Z0-9.\-_]+(?:@|%40)[a-zA-Z0-9.-]+\.[a-zA-Z]{2,3}|(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})|$) |