Detection rules › Sublime MQL

Link: Suspicious file retrieval with recipient targeting

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages containing links with '/getfile/filefor' URL paths that include the recipient's email address, indicating potential targeted file delivery or credential harvesting.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesSocial engineering

Event coverage

Rule body MQL

type.inbound
and any(body.links,
        // observed url path
        strings.icontains(.href_url.path, '/getfile/filefor')
        // with email
        and strings.icontains(.href_url.path, recipients.to[0].email.email)
)

Detection logic

Scope: inbound message.

Detects inbound messages containing links with '/getfile/filefor' URL paths that include the recipient's email address, indicating potential targeted file delivery or credential harvesting.

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.path contains '/getfile/filefor'
    • strings.icontains(.href_url.path)

Inspects: body.links, body.links[].href_url.path, recipients.to[0].email.email, type.inbound. Sensors: strings.icontains.

Indicators matched (1)

FieldMatchValue
strings.icontainssubstring/getfile/filefor