Detection rules › Sublime MQL
Link: Google Firebase dynamic link that redirects to new domain (<7 days old)
An attacker may use Google's Firebase Dynamic Links to redirect a user to a malicious site. This rule identifies Firebase Dynamic Links where the destination domain is less than a week old.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and any(body.links,
.href_url.domain.root_domain =~ "goo.gl"
and strings.icontains(.href_url.domain.domain, "app")
and any(ml.link_analysis(.).redirect_history,
network.whois(.domain).days_old < 7
)
)
Detection logic
Scope: inbound message.
An attacker may use Google's Firebase Dynamic Links to redirect a user to a malicious site. This rule identifies Firebase Dynamic Links where the destination domain is less than a week old.
- inbound message
any of
body.linkswhere all hold:- .href_url.domain.root_domain is 'goo.gl'
- .href_url.domain.domain contains 'app'
any of
ml.link_analysis(.).redirect_historywhere:- network.whois(.domain).days_old < 7
Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, type.inbound. Sensors: ml.link_analysis, network.whois, strings.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | goo.gl |
strings.icontains | substring | app |