detection.wiki

Detection rules › Sublime MQL

Link: Hotel booking spoofed display URL

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing links with hotel-related display URLs that either redirect to different domains or contain suspicious parameters commonly used in booking scams and fraudulent hotel reservation schemes.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesEvasion, Social engineering

Event coverage

Message attribute
body
body.current_thread
body.links (collection)
headers.auth_summary
sender.email
type

Rule body MQL

type.inbound
and any(body.links,
        strings.icontains(.display_url.url, 'booking.com')
        and not strings.icontains(.href_url.url,
                                  .display_url.domain.root_domain
        )
        and .display_url.domain.root_domain != .href_url.domain.root_domain
        and (
          regex.icontains(.display_url.url,
                          '(?:aid=\d{6}|label=gen\d+nr|review-bad|\b\w+\.html|expirince|hoteladmin|feedback)'
          )
          or .href_url.domain.root_domain == "share.google"
          or any(body.links, network.whois(.href_url.domain).days_old < 30)
        )
        and .mismatched
)
and not strings.icontains(body.current_thread.text,
                          "unsubscribe from this list"
)
and not (
  sender.email.domain.root_domain == "booking.com"
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Detection logic

Scope: inbound message.

Detects messages containing links with hotel-related display URLs that either redirect to different domains or contain suspicious parameters commonly used in booking scams and fraudulent hotel reservation schemes.

  1. inbound message
  2. any of body.links where all hold:
    • .display_url.url contains 'booking.com'
    • not:
      • strings.icontains(.href_url.url)
    • .display_url.domain.root_domain is not .href_url.domain.root_domain
    • any of:
      • .display_url.url matches '(?:aid=\\d{6}|label=gen\\d+nr|review-bad|\\b\\w+\\.html|expirince|hoteladmin|feedback)'
      • .href_url.domain.root_domain is 'share.google'
      • any of body.links where:
        • network.whois(.href_url.domain).days_old < 30
    • .mismatched
  3. not:
    • body.current_thread.text contains 'unsubscribe from this list'
  4. not:
    • all of:
      • sender.email.domain.root_domain is 'booking.com'
      • coalesce(headers.auth_summary.dmarc.pass)

Inspects: body.current_thread.text, body.links, body.links[].display_url.domain.root_domain, body.links[].display_url.url, body.links[].href_url.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.url, body.links[].mismatched, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: network.whois, regex.icontains, strings.icontains.

Indicators matched (5)

FieldMatchValue
strings.icontainssubstringbooking.com
regex.icontainsregex(?:aid=\d{6}|label=gen\d+nr|review-bad|\b\w+\.html|expirince|hoteladmin|feedback)
body.links[].href_url.domain.root_domainequalsshare.google
strings.icontainssubstringunsubscribe from this list
sender.email.domain.root_domainequalsbooking.com