Detection rules › Sublime MQL

Link: File sharing pretext with suspicious body and link

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing file sharing pretext with a single link to self-service creation platforms or URL shorteners, where the link display text matches the email subject and points to suspicious domains.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesSocial engineering, Evasion

Event coverage

Rule body MQL

type.inbound
and length(body.links) < 20

// file sharing pretext
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "File Sharing and Cloud Services" and .confidence != "low"
)

// the message does not contain previous threads
and length(body.previous_threads) == 0

// no PDF attachments
and length(filter(attachments, .file_type == "pdf")) == 0

// there is only a single link to the free file host
and length(filter(body.links,
                  .href_url.domain.domain in $self_service_creation_platform_domains
                  or .href_url.domain.root_domain in $self_service_creation_platform_domains
                  or .href_url.domain.domain in $url_shorteners
                  or .href_url.domain.root_domain in $url_shorteners
                  or .href_url.domain.root_domain == "dynamics.com"
           )
) == 1
// there are few distinct domains in the message
and length(distinct(body.links, .href_url.domain.root_domain)) <= 3

// body/link display text is related to the subject & links to suspicious domain
and any(body.links,
        (
          strings.icontains(.display_text, subject.base)
          or strings.icontains(body.current_thread.text,
                               strings.concat('"', subject.base, '"')
          )
        )
        and (
          .href_url.domain.domain in $self_service_creation_platform_domains
          or .href_url.domain.root_domain in $self_service_creation_platform_domains
          or .href_url.domain.domain in $url_shorteners
          or .href_url.domain.root_domain in $url_shorteners
          or .href_url.domain.root_domain == "dynamics.com"
        )

        // negate links which make use of google icons inside of a bounding box
        // filter down to the link with the same display text
        and not any(filter(html.xpath(body.html,
                                      '//a[img[@src] or .//img[@src]][.//div[contains(@style, "border:1px solid")] or ancestor::div[contains(@style, "border:1px solid")]]'
                           ).nodes,
                           // the display text is the link we're inspecting
                           ..display_text == .display_text
                    ),
                    // inside this is a reference to the google icon 
                    strings.icontains(.raw, 'gstatic.com/docs/doclist/images/')
        )
)

Detection logic

Scope: inbound message.

Detects messages containing file sharing pretext with a single link to self-service creation platforms or URL shorteners, where the link display text matches the email subject and points to suspicious domains.

  1. inbound message
  2. length(body.links) < 20
  3. any of ml.nlu_classifier(body.current_thread.text).topics where all hold:
    • .name is 'File Sharing and Cloud Services'
    • .confidence is not 'low'
  4. length(body.previous_threads) is 0
  5. length(filter(attachments, .file_type == 'pdf')) is 0
  6. length(filter(body.links, .href_url.domain.domain in $self_service_creation_platform_domains or .href_url.domain.root_domain in $self_service_creation_platform_domains or .href_url.domain.domain in $url_shorteners or .href_url.domain.root_domain in $url_shorteners or .href_url.domain.root_domain == 'dynamics.com')) is 1
  7. length(distinct(body.links, .href_url.domain.root_domain)) ≤ 3
  8. any of body.links where all hold:
    • any of:
      • strings.icontains(.display_text)
      • strings.icontains(body.current_thread.text)
    • any of:
      • .href_url.domain.domain in $self_service_creation_platform_domains
      • .href_url.domain.root_domain in $self_service_creation_platform_domains
      • .href_url.domain.domain in $url_shorteners
      • .href_url.domain.root_domain in $url_shorteners
      • .href_url.domain.root_domain is 'dynamics.com'
    • not:
      • any of filter(...) where:
        • .raw contains 'gstatic.com/docs/doclist/images/'

Inspects: attachments[].file_type, body.current_thread.text, body.html, body.links, body.links[].display_text, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.previous_threads, subject.base, type.inbound. Sensors: html.xpath, ml.nlu_classifier, strings.concat, strings.icontains. Reference lists: $self_service_creation_platform_domains, $url_shorteners.

Indicators matched (4)

FieldMatchValue
ml.nlu_classifier(body.current_thread.text).topics[].nameequalsFile Sharing and Cloud Services
attachments[].file_typeequalspdf
body.links[].href_url.domain.root_domainequalsdynamics.com
strings.icontainssubstringgstatic.com/docs/doclist/images/