Detection rules › Sublime MQL

Link: Obfuscation via userinfo with suspicious indicators

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects URLs that use the @ symbol to hide suspicious domains or URL shorteners within the link structure, excluding legitimate email addresses and malformed mailto/telto links.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesEvasion

Event coverage

Rule body MQL

type.inbound
and any(body.links,
        // this checks for a likely domain in the
        .href_url.username is not null
        and strings.contains(.href_url.username, '.')
        // and coalesce(strings.parse_domain(.href_url.username).valid, false)
        and .href_url.password is null
        and (
          .href_url.domain.domain in $url_shorteners
          or .href_url.domain.root_domain in $url_shorteners
          or .href_url.domain.domain in $free_file_hosts
          or .href_url.domain.root_domain in $free_file_hosts
          or .href_url.domain.domain in $free_subdomain_hosts
          or .href_url.domain.root_domain in $free_subdomain_hosts
          or .href_url.domain.domain in $self_service_creation_platform_domains
          or .href_url.domain.root_domain in $self_service_creation_platform_domains
          or .href_url.domain.tld in $suspicious_tlds
        )
        and not (
          coalesce(strings.parse_email(.href_url.url).domain.valid, false)
          and .parser == "hyperlink"
        )
        // we dont want to match on malformed mailto or telto links
        and not .href_url.scheme in ('mailto', "tel")
        and not regex.icontains(.href_url.username, '^(?:mail|tel)\s*to=')
        and not coalesce(regex.icontains(.href_url.query_params,
                                         '\bunsubscribe\b'
                         ),
                         false
        )

        // we dont want utm urls
        and not regex.icontains(.href_url.url,
                                'utm_(?:source|medium|term|campaign)='
        )
)

Detection logic

Scope: inbound message.

Detects URLs that use the @ symbol to hide suspicious domains or URL shorteners within the link structure, excluding legitimate email addresses and malformed mailto/telto links.

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.username is set
    • .href_url.username contains '.'
    • .href_url.password is missing
    • any of:
      • .href_url.domain.domain in $url_shorteners
      • .href_url.domain.root_domain in $url_shorteners
      • .href_url.domain.domain in $free_file_hosts
      • .href_url.domain.root_domain in $free_file_hosts
      • .href_url.domain.domain in $free_subdomain_hosts
      • .href_url.domain.root_domain in $free_subdomain_hosts
      • .href_url.domain.domain in $self_service_creation_platform_domains
      • .href_url.domain.root_domain in $self_service_creation_platform_domains
      • .href_url.domain.tld in $suspicious_tlds
    • not:
      • all of:
        • coalesce(strings.parse_email(.href_url.url).domain.valid)
        • .parser is 'hyperlink'
    • not:
      • .href_url.scheme in ('mailto', 'tel')
    • not:
      • .href_url.username matches '^(?:mail|tel)\\s*to='
    • not:
      • coalesce(regex.icontains(.href_url.query_params, '\\bunsubscribe\\b'))
    • not:
      • .href_url.url matches 'utm_(?:source|medium|term|campaign)='

Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.tld, body.links[].href_url.password, body.links[].href_url.query_params, body.links[].href_url.scheme, body.links[].href_url.url, body.links[].href_url.username, body.links[].parser, type.inbound. Sensors: regex.icontains, strings.contains, strings.parse_email. Reference lists: $free_file_hosts, $free_subdomain_hosts, $self_service_creation_platform_domains, $suspicious_tlds, $url_shorteners.

Indicators matched (7)

FieldMatchValue
strings.containssubstring.
body.links[].parserequalshyperlink
body.links[].href_url.schememembermailto
body.links[].href_url.schememembertel
regex.icontainsregex^(?:mail|tel)\s*to=
regex.icontainsregex\bunsubscribe\b
regex.icontainsregexutm_(?:source|medium|term|campaign)=