detection.wiki

Detection rules › Sublime MQL

Link: HTML file with suspicious binary fragment ending pattern

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects links to HTML files containing fragments with a suspicious pattern of alphanumeric characters followed by a 5-digit binary sequence, commonly used in malicious URL structures.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion

Event coverage

Message attribute
body
body.links (collection)
type

Rule body MQL

type.inbound
and any(body.links,
        strings.ends_with(.href_url.path, '.html')
        and regex.contains(.href_url.fragment, '\-[a-z0-9]+[01]{5}$')
)

Detection logic

Scope: inbound message.

Detects links to HTML files containing fragments with a suspicious pattern of alphanumeric characters followed by a 5-digit binary sequence, commonly used in malicious URL structures.

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.path ends with '.html'
    • .href_url.fragment matches '\\-[a-z0-9]+[01]{5}$'

Inspects: body.links, body.links[].href_url.fragment, body.links[].href_url.path, type.inbound. Sensors: regex.contains, strings.ends_with.

Indicators matched (2)

FieldMatchValue
strings.ends_withsuffix.html
regex.containsregex\-[a-z0-9]+[01]{5}$