Detection rules › Sublime MQL
Link: Google Forms link with credential theft language
Detects messages containing Google Forms links paired with credential theft language from new senders. This technique abuses Google's trusted domain to host malicious forms designed to steal user credentials.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| type |
Rule body MQL
type.inbound
// cred_theft intent
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "cred_theft" and .confidence != "low"
)
// google form link
and any(body.current_thread.links,
(
.href_url.domain.domain == "docs.google.com"
and strings.istarts_with(.href_url.path, '/form')
)
or .href_url.domain.root_domain == "forms.gle"
)
// new sender
and profile.by_sender_email().prevalence == "new"
Detection logic
Scope: inbound message.
Detects messages containing Google Forms links paired with credential theft language from new senders. This technique abuses Google's trusted domain to host malicious forms designed to steal user credentials.
- inbound message
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'cred_theft'
- .confidence is not 'low'
any of
body.current_thread.linkswhere any holds:all of:
- .href_url.domain.domain is 'docs.google.com'
- .href_url.path starts with '/form'
- .href_url.domain.root_domain is 'forms.gle'
- profile.by_sender_email().prevalence is 'new'
Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.domain, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.links[].href_url.path, body.current_thread.text, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender_email, strings.istarts_with.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | cred_theft |
body.current_thread.links[].href_url.domain.domain | equals | docs.google.com |
strings.istarts_with | prefix | /form |
body.current_thread.links[].href_url.domain.root_domain | equals | forms.gle |