Fake Zoom meeting invite with suspicious link

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects messages impersonating Zoom meetings that contain suspicious links not hosted on legitimate Zoom domains, with recipients hidden as 'Undisclosed recipients' or missing entirely. The rule identifies Zoom-related language while excluding legitimate Zoom communications and meeting summaries.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	Impersonation: Brand, Evasion, Social engineering

Event coverage

Message attribute
body
body.current_thread
body.links (collection)
headers (collection)
headers.auth_summary
recipients
recipients.to (collection)
sender.email
subject
type

Rule body MQL

type.inbound
and length(body.previous_threads) == 0
and length(ml.nlu_classifier(body.current_thread.text).topics) == 1
and all(ml.nlu_classifier(body.current_thread.text).topics,
        .name in ("Events and Webinars", "Software and App Updates")
        and .confidence != "low"
)

// Zoom meeting language
and strings.ilike(body.current_thread.text,
                  "*zoom meeting*",
                  "*meeting ID*",
                  "*participants*"
)

// suspicious recipients pattern
and (
  any(recipients.to, strings.ilike(.display_name, "undisclosed?recipients"))
  or length(recipients.to) == 0
)

// suspicious link
and not any(body.links,
            .href_url.domain.root_domain in (
              "zoom.us",
              "zoom.com",
              "emailprotection.link"
            )
            and any(.href_url.query_params_decoded['pwd'], . is not null)
)
and (
  any(body.links,
      .href_url.domain.tld in $suspicious_tlds
      // country code second-level domain
      or strings.istarts_with(.href_url.domain.tld, "com.")
      or (
        (
          length(ml.link_analysis(.).files_downloaded) > 0
          // Zoom logo on page
          or ml.link_analysis(.).credphish.brand.name == "Zoom"
          // blocked by a Cloudflare CAPTCHA
          or strings.icontains(ml.link_analysis(.).final_dom.raw,
                               'https://challenges.cloudflare.com/turnstile/',
          )
        )
        and ml.link_analysis(.).effective_url.domain.root_domain not in (
          "zoom.us",
          "zoom.com"
        )
      )
  )
)

// negate auto-generated meeting summaries
and not (
  strings.icontains(body.current_thread.text, "meeting summary")
  and strings.icontains(body.current_thread.text,
                        "AI-generated content may be inaccurate or misleading."
  )
)
and not (
  (subject.is_reply or subject.is_forward)
  and (length(headers.references) > 0 or headers.in_reply_to is not null)
)
// Not from a legitimate Zoom domain
and not (
  sender.email.domain.root_domain in (
    "zoom.us",
    "zuora.com",
    "zoomgov.com",
    "zoom.com",
    "zoom-x.de"
  )
  and headers.auth_summary.dmarc.pass
)

Detection logic

Scope: inbound message.

inbound message
length(body.previous_threads) is 0
length(ml.nlu_classifier(body.current_thread.text).topics) is 1
all of ml.nlu_classifier(body.current_thread.text).topics where all hold:
- .name in ('Events and Webinars', 'Software and App Updates')
- .confidence is not 'low'
body.current_thread.text matches any of 3 patterns
- *zoom meeting*
- *meeting ID*
- *participants*
any of:
- any of recipients.to where:
  - .display_name matches 'undisclosed?recipients'
- length(recipients.to) is 0
not:
- any of body.links where all hold:
  - .href_url.domain.root_domain in ('zoom.us', 'zoom.com', 'emailprotection.link')
  - any of .href_url.query_params_decoded['pwd'] where:
    
    . is set
any of body.links where any holds:
- .href_url.domain.tld in $suspicious_tlds
- .href_url.domain.tld starts with 'com.'
- all of:
  - any of:
    
    length(ml.link_analysis(.).files_downloaded) > 0
    ml.link_analysis(.).credphish.brand.name is 'Zoom'
    ml.link_analysis(.).final_dom.raw contains 'https://challenges.cloudflare.com/turnstile/'
  - ml.link_analysis(.).effective_url.domain.root_domain not in ('zoom.us', 'zoom.com')
not:
- all of:
  - body.current_thread.text contains 'meeting summary'
  - body.current_thread.text contains 'AI-generated content may be inaccurate or misleading.'
not:
- all of:
  - any of:
    
    subject.is_reply
    subject.is_forward
  - any of:
    
    length(headers.references) > 0
    headers.in_reply_to is set
not:
- all of:
  - sender.email.domain.root_domain in ('zoom.us', 'zuora.com', 'zoomgov.com', 'zoom.com', 'zoom-x.de')
  - headers.auth_summary.dmarc.pass

Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.tld, body.links[].href_url.query_params_decoded['pwd'], body.previous_threads, headers.auth_summary.dmarc.pass, headers.in_reply_to, headers.references, recipients.to, recipients.to[].display_name, sender.email.domain.root_domain, subject.is_forward, subject.is_reply, type.inbound. Sensors: ml.link_analysis, ml.nlu_classifier, strings.icontains, strings.ilike, strings.istarts_with. Reference lists: $suspicious_tlds.

Indicators matched (18)

Field	Match	Value
`ml.nlu_classifier(body.current_thread.text).topics[].name`	member	`Events and Webinars`
`ml.nlu_classifier(body.current_thread.text).topics[].name`	member	`Software and App Updates`
`strings.ilike`	substring	`zoom meeting`
`strings.ilike`	substring	`meeting ID`
`strings.ilike`	substring	`participants`
`strings.ilike`	substring	`undisclosed?recipients`
`body.links[].href_url.domain.root_domain`	member	`zoom.us`
`body.links[].href_url.domain.root_domain`	member	`zoom.com`
`body.links[].href_url.domain.root_domain`	member	`emailprotection.link`
`strings.istarts_with`	prefix	`com.`
`strings.icontains`	substring	`https://challenges.cloudflare.com/turnstile/`
`strings.icontains`	substring	`meeting summary`

6 more

`strings.icontains`	substring	`AI-generated content may be inaccurate or misleading.`
`sender.email.domain.root_domain`	member	`zoom.us`
`sender.email.domain.root_domain`	member	`zuora.com`
`sender.email.domain.root_domain`	member	`zoomgov.com`
`sender.email.domain.root_domain`	member	`zoom.com`
`sender.email.domain.root_domain`	member	`zoom-x.de`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)