Detection rules › Sublime MQL

Link: /index.php enclosed in three asterisks

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing a specific pattern of triple asterisks surrounding HTTP links that point to PHP index pages with query parameters, indicating potential malicious behavior. This specific pattern has been observed within messages leading to FakeAV/Tech Support scams.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware, Callback Phishing
Tactics and techniquesSocial engineering

Event coverage

Message attribute
body.current_thread
type

Rule body MQL

type.inbound
and strings.count(body.current_thread.text, '* * *') == 2
and strings.contains(body.current_thread.text, ': http')
and strings.contains(body.current_thread.text, '/index.php?')
and regex.icontains(body.current_thread.text,
                    '\* \* \*(?:[^\r\n]+|[\r\n][^\r\n]*): https?:\/\/.*\/index\.php\?[a-z0-9]+(?:[^\r\n]+|[\r\n][^\r\n]*)\* \* \*'
)

Detection logic

Scope: inbound message.

Detects messages containing a specific pattern of triple asterisks surrounding HTTP links that point to PHP index pages with query parameters, indicating potential malicious behavior. This specific pattern has been observed within messages leading to FakeAV/Tech Support scams.

  1. inbound message
  2. strings.count(body.current_thread.text, '* * *') is 2
  3. body.current_thread.text contains ': http'
  4. body.current_thread.text contains '/index.php?'
  5. body.current_thread.text matches '\\* \\* \\*(?:[^\\r\\n]+|[\\r\\n][^\\r\\n]*): https?:\\/\\/.*\\/index\\.php\\?[a-z0-9]+(?:[^\\r\\n]+|[\\r\\n][^\\r\\n]*)\\* \\* \\*'

Inspects: body.current_thread.text, type.inbound. Sensors: regex.icontains, strings.contains, strings.count.

Indicators matched (3)

FieldMatchValue
strings.containssubstring: http
strings.containssubstring/index.php?
regex.icontainsregex\* \* \*(?:[^\r\n]+|[\r\n][^\r\n]*): https?:\/\/.*\/index\.php\?[a-z0-9]+(?:[^\r\n]+|[\r\n][^\r\n]*)\* \* \*