Detection rules › Sublime MQL
Link: Google Drawings link from new sender
Detects messages containing Google Drawings links from previously unseen senders, which may indicate abuse of Google's drawing service for malicious content delivery.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, BEC/Fraud |
| Tactics and techniques | Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| type |
Rule body MQL
type.inbound
// google drawings link
and any(body.current_thread.links,
.href_url.domain.domain == "docs.google.com"
and strings.istarts_with(.href_url.path, '/drawings')
and (
strings.icontains(.href_url.path, '/preview')
or any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "cred_theft" and .confidence != "low"
)
)
)
and profile.by_sender_email().prevalence == "new"
Detection logic
Scope: inbound message.
Detects messages containing Google Drawings links from previously unseen senders, which may indicate abuse of Google's drawing service for malicious content delivery.
- inbound message
any of
body.current_thread.linkswhere all hold:- .href_url.domain.domain is 'docs.google.com'
- .href_url.path starts with '/drawings'
any of:
- .href_url.path contains '/preview'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'cred_theft'
- .confidence is not 'low'
- profile.by_sender_email().prevalence is 'new'
Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.domain, body.current_thread.links[].href_url.path, body.current_thread.text, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender_email, strings.icontains, strings.istarts_with.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
body.current_thread.links[].href_url.domain.domain | equals | docs.google.com |
strings.istarts_with | prefix | /drawings |
strings.icontains | substring | /preview |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | cred_theft |