Detection rules › Sublime MQL
Google Accelerated Mobile Pages (AMP) abuse
This rule is designed to identify phishing attempts abusing Google AMP's URL structure for malicious activities. The rule aims to detect specific URL patterns, further analyzing both message content, as well as the destination of the link to distinguish between legitimate Google AMP pages and potential malicious usage.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Impersonation: Brand, Open redirect |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| recipients |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
// Any body links with a domain SLD of 'google' and a path starting with /amp
and any(body.links,
.href_url.domain.sld == "google"
and strings.starts_with(.href_url.path, "/amp/")
// Brand Logo detected that is not google
and (
any(ml.logo_detect(file.message_screenshot()).brands,
.name is not null and .name != "Google"
)
// or the page has a login or captcha
or (
ml.link_analysis(.).credphish.contains_login
or ml.link_analysis(.).credphish.contains_captcha
)
// or linkanalysis concludes phishing of medium to high confidence
or any([ml.link_analysis(.)],
.credphish.disposition == "phishing"
and .credphish.brand.confidence in ("medium", "high")
)
// or NLU detected cred theft on the landing page
or any(file.explode(ml.link_analysis(.).screenshot),
any(ml.nlu_classifier(.scan.ocr.raw).intents,
.name == "cred_theft" and .confidence in ("medium", "high")
)
// captcha partially loaded
or strings.icontains(.scan.ocr.raw,
"Checking if the site connection is secure"
)
)
// or the link display text contains "password"
or strings.icontains(.display_text, "password")
// or the link contains the recipients email in the url path
or any(recipients.to,
strings.icontains(..href_url.path, .email.email)
and (
.email.domain.valid
or strings.icontains(.display_name, "undisclosed")
)
)
)
)
Detection logic
Scope: inbound message.
This rule is designed to identify phishing attempts abusing Google AMP's URL structure for malicious activities. The rule aims to detect specific URL patterns, further analyzing both message content, as well as the destination of the link to distinguish between legitimate Google AMP pages and potential malicious usage.
- inbound message
any of
body.linkswhere all hold:- .href_url.domain.sld is 'google'
- .href_url.path starts with '/amp/'
any of:
any of
ml.logo_detect(file.message_screenshot()).brandswhere all hold:- .name is set
- .name is not 'Google'
any of:
- ml.link_analysis(.).credphish.contains_login
- ml.link_analysis(.).credphish.contains_captcha
any of
[ml.link_analysis(.)]where all hold:- .credphish.disposition is 'phishing'
- .credphish.brand.confidence in ('medium', 'high')
any of
file.explode(...)where any holds:any of
ml.nlu_classifier(.scan.ocr.raw).intentswhere all hold:- .name is 'cred_theft'
- .confidence in ('medium', 'high')
- .scan.ocr.raw contains 'Checking if the site connection is secure'
- .display_text contains 'password'
any of
recipients.towhere all hold:- strings.icontains(.href_url.path)
any of:
- .email.domain.valid
- .display_name contains 'undisclosed'
Inspects: body.links, body.links[].display_text, body.links[].href_url.domain.sld, body.links[].href_url.path, recipients.to, recipients.to[].display_name, recipients.to[].email.domain.valid, recipients.to[].email.email, type.inbound. Sensors: file.explode, file.message_screenshot, ml.link_analysis, ml.logo_detect, ml.nlu_classifier, strings.icontains, strings.starts_with.
Indicators matched (11)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.sld | equals | google |
strings.starts_with | prefix | /amp/ |
[ml.link_analysis(body.links[])][].credphish.disposition | equals | phishing |
[ml.link_analysis(body.links[])][].credphish.brand.confidence | member | medium |
[ml.link_analysis(body.links[])][].credphish.brand.confidence | member | high |
ml.nlu_classifier(file.explode(...)[].scan.ocr.raw).intents[].name | equals | cred_theft |
ml.nlu_classifier(file.explode(...)[].scan.ocr.raw).intents[].confidence | member | medium |
ml.nlu_classifier(file.explode(...)[].scan.ocr.raw).intents[].confidence | member | high |
strings.icontains | substring | Checking if the site connection is secure |
strings.icontains | substring | password |
strings.icontains | substring | undisclosed |