Detection rules › Sublime MQL
Link: Suspicious file retrieval with recipient targeting
Detects inbound messages containing links with '/getfile/filefor' URL paths that include the recipient's email address, indicating potential targeted file delivery or credential harvesting.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and any(body.links,
// observed url path
strings.icontains(.href_url.path, '/getfile/filefor')
// with email
and strings.icontains(.href_url.path, recipients.to[0].email.email)
)
Detection logic
Scope: inbound message.
Detects inbound messages containing links with '/getfile/filefor' URL paths that include the recipient's email address, indicating potential targeted file delivery or credential harvesting.
- inbound message
any of
body.linkswhere all hold:- .href_url.path contains '/getfile/filefor'
- strings.icontains(.href_url.path)
Inspects: body.links, body.links[].href_url.path, recipients.to[0].email.email, type.inbound. Sensors: strings.icontains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | /getfile/filefor |