Detection rules › Sublime MQL
Link: Direct link to gamma.app document with mode parameter
Detects URLs linking to Gamma App presentation or document mode, which has been used to host malicious content due to its trusted domain status and presentation capabilities.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Free file host, Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and length(body.links) < 10
and any(body.links,
(
.href_url.domain.root_domain == "gamma.app"
or strings.icontains(.href_url.query_params, 'gamma.app')
or strings.icontains(.href_url.query_params, 'gamma%2eapp')
or strings.icontains(.href_url.query_params, 'gamma%252eapp')
)
and regex.icontains(.href_url.query_params, 'mode=(present|doc)')
)
Detection logic
Scope: inbound message.
Detects URLs linking to Gamma App presentation or document mode, which has been used to host malicious content due to its trusted domain status and presentation capabilities.
- inbound message
- length(body.links) < 10
any of
body.linkswhere all hold:any of:
- .href_url.domain.root_domain is 'gamma.app'
- .href_url.query_params contains 'gamma.app'
- .href_url.query_params contains 'gamma%2eapp'
- .href_url.query_params contains 'gamma%252eapp'
- .href_url.query_params matches 'mode=(present|doc)'
Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.query_params, type.inbound. Sensors: regex.icontains, strings.icontains.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | gamma.app |
strings.icontains | substring | gamma.app |
strings.icontains | substring | gamma%2eapp |
strings.icontains | substring | gamma%252eapp |
regex.icontains | regex | mode=(present|doc) |