Link: Free file hosting with undisclosed recipients

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects messages containing links to free file hosting or subdomain services that are sent to undisclosed recipients or only CC/BCC recipients. The rule identifies suspicious distribution patterns where legitimate recipients are hidden, potentially indicating mass distribution of malicious content through file sharing platforms.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing, Malware/Ransomware
Tactics and techniques	Free file host, Free subdomain host, Evasion

Event coverage

Message attribute
body
body.current_thread
body.previous_threads (collection)
headers (collection)
headers.auth_summary
headers.hops (collection)
headers.return_path
mailbox.email
recipients
recipients.to (collection)
sender.email
type

Rule body MQL

type.inbound
// no previous threads
and (
  length(body.previous_threads) == 0
  // If there is a previous thread, it is unrelated to current thread
  or any(body.previous_threads, .sender.email.email != mailbox.email.email)
)

// few links that aren't "social" links
and 0 < length(filter(body.current_thread.links,
                      .href_url.domain.root_domain not in (
                        'x.com',
                        'facebook.com',
                        'twitter.com',
                        'instagram.com',
                        'youtube.com',
                        'linkedin.com'
                      )
               )
) < 10

// undisclosed recipients or all recipients cc'd
and (
  any(recipients.to, strings.ilike(.display_name, "undisclosed?recipients"))
  or (length(recipients.cc) > 0 and length(recipients.to) == 0)
  or (length(recipients.bcc) > 0 and length(recipients.to) == 0)
  or (
    length(recipients.to) == 1
    and length(recipients.cc) == 0
    and length(recipients.bcc) == 0
    and all(recipients.to, .email.email == sender.email.email)
    and all(recipients.to, .email.email != mailbox.email.email)
  )
)

// links to free file hosts or free subdomain hosts
and any(body.current_thread.links,
        (
          .href_url.domain.root_domain in $free_file_hosts
          or .href_url.domain.root_domain in $free_subdomain_hosts
        )
        and .visible
        and not (
          .href_url.domain.root_domain == "googleusercontent.com"
          and strings.istarts_with(.href_url.path, "/mail-sig")
        )
        and not .href_url.domain.domain in $tenant_domains
)

// negate listmailers & benign threads
and not (
  any(headers.hops, any(.fields, .name == "List-Unsubscribe"))
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name == "benign" and .confidence == "high"
  )
)
and not (
  (
    sender.email.domain.root_domain in ("twilio.com", "zendesk.com")
    or headers.return_path.domain.root_domain in ("twilio.com", "zendesk.com")
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

// unsolicited and passing auth, or failing/missing dmarc
and (
  (
    coalesce(headers.auth_summary.dmarc.pass, false)
    and not profile.by_sender().solicited
  )
  or profile.by_sender_email().days_since.last_inbound > 365
  or (not coalesce(headers.auth_summary.dmarc.pass, false))
)

Detection logic

Scope: inbound message.

inbound message
any of:
- length(body.previous_threads) is 0
- any of body.previous_threads where:
  - .sender.email.email is not mailbox.email.email
all of:
- length(filter(body.current_thread.links, .href_url.domain.root_domain not in ('x.com', 'facebook.com', 'twitter.com', 'instagram.com', 'youtube.com', 'linkedin.com'))) > 0
- length(filter(body.current_thread.links, .href_url.domain.root_domain not in ('x.com', 'facebook.com', 'twitter.com', 'instagram.com', 'youtube.com', 'linkedin.com'))) < 10
any of:
- any of recipients.to where:
  - .display_name matches 'undisclosed?recipients'
- all of:
  - length(recipients.cc) > 0
  - length(recipients.to) is 0
- all of:
  - length(recipients.bcc) > 0
  - length(recipients.to) is 0
- all of:
  - length(recipients.to) is 1
  - length(recipients.cc) is 0
  - length(recipients.bcc) is 0
  - all of recipients.to where:
    
    .email.email is sender.email.email
  - all of recipients.to where:
    
    .email.email is not mailbox.email.email
any of body.current_thread.links where all hold:
- any of:
  - .href_url.domain.root_domain in $free_file_hosts
  - .href_url.domain.root_domain in $free_subdomain_hosts
- .visible
- not:
  - all of:
    
    .href_url.domain.root_domain is 'googleusercontent.com'
    .href_url.path starts with '/mail-sig'
- not:
  - .href_url.domain.domain in $tenant_domains
none of:
- any of headers.hops where:
  - any of .fields where:
    
    .name is 'List-Unsubscribe'
- any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
  - .name is 'benign'
  - .confidence is 'high'
not:
- all of:
  - any of:
    
    sender.email.domain.root_domain in ('twilio.com', 'zendesk.com')
    headers.return_path.domain.root_domain in ('twilio.com', 'zendesk.com')
  - coalesce(headers.auth_summary.dmarc.pass)
any of:
- all of:
  - coalesce(headers.auth_summary.dmarc.pass)
  - not:
    
    profile.by_sender().solicited
- profile.by_sender_email().days_since.last_inbound > 365
- not:
  - coalesce(headers.auth_summary.dmarc.pass)

Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.domain, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.links[].href_url.path, body.current_thread.links[].visible, body.current_thread.text, body.previous_threads, body.previous_threads[].sender.email.email, headers.auth_summary.dmarc.pass, headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.return_path.domain.root_domain, mailbox.email.email, recipients.bcc, recipients.cc, recipients.to, recipients.to[].display_name, recipients.to[].email.email, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender, profile.by_sender_email, strings.ilike, strings.istarts_with. Reference lists: $free_file_hosts, $free_subdomain_hosts, $tenant_domains.

Indicators matched (16)

Field	Match	Value
`body.current_thread.links[].href_url.domain.root_domain`	member	`x.com`
`body.current_thread.links[].href_url.domain.root_domain`	member	`facebook.com`
`body.current_thread.links[].href_url.domain.root_domain`	member	`twitter.com`
`body.current_thread.links[].href_url.domain.root_domain`	member	`instagram.com`
`body.current_thread.links[].href_url.domain.root_domain`	member	`youtube.com`
`body.current_thread.links[].href_url.domain.root_domain`	member	`linkedin.com`
`strings.ilike`	substring	`undisclosed?recipients`
`body.current_thread.links[].href_url.domain.root_domain`	equals	`googleusercontent.com`
`strings.istarts_with`	prefix	`/mail-sig`
`headers.hops[].fields[].name`	equals	`List-Unsubscribe`
`ml.nlu_classifier(body.current_thread.text).intents[].name`	equals	`benign`
`ml.nlu_classifier(body.current_thread.text).intents[].confidence`	equals	`high`

4 more

`sender.email.domain.root_domain`	member	`twilio.com`
`sender.email.domain.root_domain`	member	`zendesk.com`
`headers.return_path.domain.root_domain`	member	`twilio.com`
`headers.return_path.domain.root_domain`	member	`zendesk.com`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)