Detection rules › Sublime MQL

Link: Google Forms link with credential theft language

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing Google Forms links paired with credential theft language from new senders. This technique abuses Google's trusted domain to host malicious forms designed to steal user credentials.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesSocial engineering

Event coverage

Message attribute
body.current_thread
type

Rule body MQL

type.inbound
// cred_theft intent
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)
// google form link
and any(body.current_thread.links,
        (
          .href_url.domain.domain == "docs.google.com"
          and strings.istarts_with(.href_url.path, '/form')
        )
        or .href_url.domain.root_domain == "forms.gle"
)
// new sender
and profile.by_sender_email().prevalence == "new"

Detection logic

Scope: inbound message.

Detects messages containing Google Forms links paired with credential theft language from new senders. This technique abuses Google's trusted domain to host malicious forms designed to steal user credentials.

  1. inbound message
  2. any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
    • .name is 'cred_theft'
    • .confidence is not 'low'
  3. any of body.current_thread.links where any holds:
    • all of:
      • .href_url.domain.domain is 'docs.google.com'
      • .href_url.path starts with '/form'
    • .href_url.domain.root_domain is 'forms.gle'
  4. profile.by_sender_email().prevalence is 'new'

Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.domain, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.links[].href_url.path, body.current_thread.text, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender_email, strings.istarts_with.

Indicators matched (4)

FieldMatchValue
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscred_theft
body.current_thread.links[].href_url.domain.domainequalsdocs.google.com
strings.istarts_withprefix/form
body.current_thread.links[].href_url.domain.root_domainequalsforms.gle