Detection rules › Sublime MQL
Link to auto-downloaded file with Google Drive branding
A link in the body of the email downloads a file from a site that uses Google Drive branding as employed by threat actors, such as Qakbot.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and length(body.links) < 10
and any(body.links,
// This isn't a Google Drive link
.href_url.domain.root_domain != "google.com"
and
// There are files downloaded
length(ml.link_analysis(.).files_downloaded) > 0
and
// Google Drive branding
ml.link_analysis(.).credphish.brand.name == "GoogleDrive"
and ml.link_analysis(.).credphish.brand.confidence == "high"
and
// Hi from Qakbot
any(file.explode(ml.link_analysis(.).screenshot),
any([
"the file is not displayed correctly",
"use local downloaded file"
],
strings.icontains(..scan.ocr.raw, .)
)
)
)
and (
not profile.by_sender().solicited
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
Detection logic
Scope: inbound message.
A link in the body of the email downloads a file from a site that uses Google Drive branding as employed by threat actors, such as Qakbot.
- inbound message
- length(body.links) < 10
any of
body.linkswhere all hold:- .href_url.domain.root_domain is not 'google.com'
- length(ml.link_analysis(.).files_downloaded) > 0
- ml.link_analysis(.).credphish.brand.name is 'GoogleDrive'
- ml.link_analysis(.).credphish.brand.confidence is 'high'
any of
file.explode(...)where:any of
['the file is not displayed correctly', 'use local downloaded file']where:- strings.icontains(.scan.ocr.raw)
any of:
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
Inspects: body.links, body.links[].href_url.domain.root_domain, type.inbound. Sensors: file.explode, ml.link_analysis, profile.by_sender, strings.icontains.