Detection rules › Sublime MQL
Link to auto-downloaded file with Adobe branding
A link in the body of the email downloads a file from a site that uses Adobe branding as employed by threat actors, such as Qakbot.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
Rule body MQL
type.inbound
and any(body.links,
// There are files downloaded
length(ml.link_analysis(.).files_downloaded) > 0
and
// Adobe branding
ml.link_analysis(.).credphish.brand.name == "Adobe"
and ml.link_analysis(.).credphish.brand.confidence == "high"
and
// Qakbot text for user coercion
any(file.explode(ml.link_analysis(.).screenshot),
all(["the file is not displayed correctly", "document password"],
strings.icontains(..scan.ocr.raw, .)
)
)
)
and (
not profile.by_sender().solicited
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
Detection logic
Scope: inbound message.
A link in the body of the email downloads a file from a site that uses Adobe branding as employed by threat actors, such as Qakbot.
- inbound message
any of
body.linkswhere all hold:- length(ml.link_analysis(.).files_downloaded) > 0
- ml.link_analysis(.).credphish.brand.name is 'Adobe'
- ml.link_analysis(.).credphish.brand.confidence is 'high'
any of
file.explode(...)where:all of
['the file is not displayed correctly', 'document password']where:- strings.icontains(.scan.ocr.raw)
any of:
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
Inspects: body.links, type.inbound. Sensors: file.explode, ml.link_analysis, profile.by_sender, strings.icontains.