Detection rules › Sublime MQL
Link: File sharing pretext with suspicious body and link
Detects messages containing file sharing pretext with a single link to self-service creation platforms or URL shorteners, where the link display text matches the email subject and points to suspicious domains.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Social engineering, Evasion |
Event coverage
Rule body MQL
type.inbound
and length(body.links) < 20
// file sharing pretext
and any(ml.nlu_classifier(body.current_thread.text).topics,
.name == "File Sharing and Cloud Services" and .confidence != "low"
)
// the message does not contain previous threads
and length(body.previous_threads) == 0
// no PDF attachments
and length(filter(attachments, .file_type == "pdf")) == 0
// there is only a single link to the free file host
and length(filter(body.links,
.href_url.domain.domain in $self_service_creation_platform_domains
or .href_url.domain.root_domain in $self_service_creation_platform_domains
or .href_url.domain.domain in $url_shorteners
or .href_url.domain.root_domain in $url_shorteners
or .href_url.domain.root_domain == "dynamics.com"
)
) == 1
// there are few distinct domains in the message
and length(distinct(body.links, .href_url.domain.root_domain)) <= 3
// body/link display text is related to the subject & links to suspicious domain
and any(body.links,
(
strings.icontains(.display_text, subject.base)
or strings.icontains(body.current_thread.text,
strings.concat('"', subject.base, '"')
)
)
and (
.href_url.domain.domain in $self_service_creation_platform_domains
or .href_url.domain.root_domain in $self_service_creation_platform_domains
or .href_url.domain.domain in $url_shorteners
or .href_url.domain.root_domain in $url_shorteners
or .href_url.domain.root_domain == "dynamics.com"
)
// negate links which make use of google icons inside of a bounding box
// filter down to the link with the same display text
and not any(filter(html.xpath(body.html,
'//a[img[@src] or .//img[@src]][.//div[contains(@style, "border:1px solid")] or ancestor::div[contains(@style, "border:1px solid")]]'
).nodes,
// the display text is the link we're inspecting
..display_text == .display_text
),
// inside this is a reference to the google icon
strings.icontains(.raw, 'gstatic.com/docs/doclist/images/')
)
)
Detection logic
Scope: inbound message.
Detects messages containing file sharing pretext with a single link to self-service creation platforms or URL shorteners, where the link display text matches the email subject and points to suspicious domains.
- inbound message
- length(body.links) < 20
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .name is 'File Sharing and Cloud Services'
- .confidence is not 'low'
- length(body.previous_threads) is 0
- length(filter(attachments, .file_type == 'pdf')) is 0
- length(filter(body.links, .href_url.domain.domain in $self_service_creation_platform_domains or .href_url.domain.root_domain in $self_service_creation_platform_domains or .href_url.domain.domain in $url_shorteners or .href_url.domain.root_domain in $url_shorteners or .href_url.domain.root_domain == 'dynamics.com')) is 1
- length(distinct(body.links, .href_url.domain.root_domain)) ≤ 3
any of
body.linkswhere all hold:any of:
- strings.icontains(.display_text)
- strings.icontains(body.current_thread.text)
any of:
- .href_url.domain.domain in $self_service_creation_platform_domains
- .href_url.domain.root_domain in $self_service_creation_platform_domains
- .href_url.domain.domain in $url_shorteners
- .href_url.domain.root_domain in $url_shorteners
- .href_url.domain.root_domain is 'dynamics.com'
not:
any of
filter(...)where:- .raw contains 'gstatic.com/docs/doclist/images/'
Inspects: attachments[].file_type, body.current_thread.text, body.html, body.links, body.links[].display_text, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.previous_threads, subject.base, type.inbound. Sensors: html.xpath, ml.nlu_classifier, strings.concat, strings.icontains. Reference lists: $self_service_creation_platform_domains, $url_shorteners.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
ml.nlu_classifier(body.current_thread.text).topics[].name | equals | File Sharing and Cloud Services |
attachments[].file_type | equals | pdf |
body.links[].href_url.domain.root_domain | equals | dynamics.com |
strings.icontains | substring | gstatic.com/docs/doclist/images/ |