Detection rules › Sublime MQL
Link: Common hidden directory observed
Links in the message point to sensitive system directories like .git, .env, or .well-known that could expose confidential configuration data or system files. Actors will often abuse these directories to hide credential phishing landing pages of compromised sites.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and 0 < length(body.links) <= 10
and any(body.links,
(
strings.icontains(.href_url.path, "/.well-known/")
and (
// well-known with a directory behind it
(
regex.icontains(.href_url.path, '\/\.well-known\/[^\/]+\/')
// doesn't contain anything after /pki-validation/ or contains godaddy.html after (which is their location for the validation)
and not regex.imatch(.href_url.path,
'/.well-known/pki-validation/(?:godaddy.html)?'
)
)
// or a fragment in the url
or .href_url.fragment is not null
)
)
or strings.icontains(.href_url.path, "/.js/")
or strings.icontains(.href_url.path, "/.env/")
or strings.icontains(.href_url.path, "/.git/")
or strings.icontains(.href_url.path, "/.svn/")
or strings.icontains(.href_url.path, "/.hg/")
or strings.icontains(.href_url.path, "/.DS_Store/")
or strings.icontains(.href_url.path, "/.htpasswd/")
or strings.icontains(.href_url.path, "/.htaccess/")
or strings.icontains(.href_url.path, "/.bash_history/")
or strings.icontains(.href_url.path, "/.bashrc/")
or strings.icontains(.href_url.path, "/.zshrc/")
or strings.icontains(.href_url.path, "/.profile/")
or strings.icontains(.href_url.path, "/.wp/")
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Links in the message point to sensitive system directories like .git, .env, or .well-known that could expose confidential configuration data or system files. Actors will often abuse these directories to hide credential phishing landing pages of compromised sites.
- inbound message
all of:
- length(body.links) > 0
- length(body.links) ≤ 10
any of
body.linkswhere any holds:all of:
- .href_url.path contains '/.well-known/'
any of:
all of:
- .href_url.path matches '\\/\\.well-known\\/[^\\/]+\\/'
not:
- .href_url.path matches '/.well-known/pki-validation/(?:godaddy.html)?'
- .href_url.fragment is set
- .href_url.path contains '/.js/'
- .href_url.path contains '/.env/'
- .href_url.path contains '/.git/'
- .href_url.path contains '/.svn/'
- .href_url.path contains '/.hg/'
- .href_url.path contains '/.DS_Store/'
- .href_url.path contains '/.htpasswd/'
- .href_url.path contains '/.htaccess/'
- .href_url.path contains '/.bash_history/'
- .href_url.path contains '/.bashrc/'
- .href_url.path contains '/.zshrc/'
- .href_url.path contains '/.profile/'
- .href_url.path contains '/.wp/'
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: body.links, body.links[].href_url.fragment, body.links[].href_url.path, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: regex.icontains, regex.imatch, strings.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (16)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | /.well-known/ |
regex.icontains | regex | \/\.well-known\/[^\/]+\/ |
regex.imatch | regex | /.well-known/pki-validation/(?:godaddy.html)? |
strings.icontains | substring | /.js/ |
strings.icontains | substring | /.env/ |
strings.icontains | substring | /.git/ |
strings.icontains | substring | /.svn/ |
strings.icontains | substring | /.hg/ |
strings.icontains | substring | /.DS_Store/ |
strings.icontains | substring | /.htpasswd/ |
strings.icontains | substring | /.htaccess/ |
strings.icontains | substring | /.bash_history/ |
4 more
strings.icontains | substring | /.bashrc/ |
strings.icontains | substring | /.zshrc/ |
strings.icontains | substring | /.profile/ |
strings.icontains | substring | /.wp/ |