Detection rules › Sublime MQL
Link: GoPhish query param values
Detects links containing a 7-character alphanumeric 'rid' (default) query parameter, or any other variant identified, commonly used in tracking and targeting systems for malicious purposes.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.domain.root_domain not in $tranco_50k
// few body links
and length(body.links) < 20
// Adding loop of different query param values
// https://github.com/fin3ss3g0d/evilgophish/blob/main/replace_rid.sh
and any(["mid", "rid"],
any(body.links,
// not a common marketing url rewriter
not .href_url.domain.root_domain == "vtiger.com"
and not strings.icontains(.href_url.url, "vtiger.com")
// myshopify return tracking numbers
and not (
length(.href_url.query_params_decoded["tracking_number"]) == 1
and length(.href_url.query_params_decoded[..]) == 1
)
// the mid value present
and length(.href_url.query_params_decoded[..]) == 1
// the mid value is 7 bytes
and length(.href_url.query_params_decoded[..][0]) == 7
// contains letters and numbers
and regex.imatch(.href_url.query_params_decoded[..][0],
'^[a-z0-9]{7}$'
)
and not regex.match(.href_url.query_params_decoded[..][0],
// not just numbers - ~0.00046% chance of being all numbers
'^[0-9]{7}$',
// not just lower case letters ~0.31% chance of all lowercase
'^[a-z]{7}$',
// not just upper case letters ~0.31% chance of being all uppercase
'^[A-Z]{7}$',
// a single letter followed by digits has ~0.00151% chance
'^[A-Za-z]\d{6}$'
)
// and not a common value observed in benign samples
and not .href_url.query_params_decoded[..][0] == "Emailer"
// .href_url.query_params_decoded is the wrong type for length
// so count the number of param values, and ensure it's 3 or less
and regex.icount(.href_url.query_params, '=[^\=]+(?:&|$)') <= 3
)
)
// not high trust sender domains
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
and not profile.by_sender_email().any_messages_benign
Detection logic
Scope: inbound message.
Detects links containing a 7-character alphanumeric 'rid' (default) query parameter, or any other variant identified, commonly used in tracking and targeting systems for malicious purposes.
- inbound message
- sender.email.domain.root_domain not in $tranco_50k
- length(body.links) < 20
any of
['mid', 'rid']where:any of
body.linkswhere all hold:not:
- .href_url.domain.root_domain is 'vtiger.com'
not:
- .href_url.url contains 'vtiger.com'
not:
all of:
- length(.href_url.query_params_decoded['tracking_number']) is 1
- length(.href_url.query_params_decoded[]) is 1
- length(.href_url.query_params_decoded[]) is 1
- length(.href_url.query_params_decoded[][0]) is 7
- .href_url.query_params_decoded[][0] matches '^[a-z0-9]{7}$'
not:
.href_url.query_params_decoded[][0] matches any of 4 patterns
^[0-9]{7}$^[a-z]{7}$^[A-Z]{7}$^[A-Za-z]\d{6}$
not:
- .href_url.query_params_decoded[][0] is 'Emailer'
- regex.icount(.href_url.query_params, '=[^\\=]+(?:&|$)') ≤ 3
not:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
- coalesce(headers.auth_summary.dmarc.pass)
not:
- profile.by_sender_email().any_messages_benign
Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.query_params, body.links[].href_url.query_params_decoded['tracking_number'], body.links[].href_url.query_params_decoded[], body.links[].href_url.query_params_decoded[][0], body.links[].href_url.url, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender_email, regex.icount, regex.imatch, regex.match, strings.icontains. Reference lists: $high_trust_sender_root_domains, $tranco_50k.
Indicators matched (9)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | vtiger.com |
strings.icontains | substring | vtiger.com |
regex.imatch | regex | ^[a-z0-9]{7}$ |
regex.match | regex | ^[0-9]{7}$ |
regex.match | regex | ^[a-z]{7}$ |
regex.match | regex | ^[A-Z]{7}$ |
regex.match | regex | ^[A-Za-z]\d{6}$ |
body.links[].href_url.query_params_decoded[][0] | equals | Emailer |
regex.icount | regex | =[^\=]+(?:&|$) |