Detection rules › Sublime MQL
Link: IPFS
Detects messages containing links that have 'ipfs' in the domain, or unanalyzed links that contain 'ipfs' in the url. IPFS has been recently observed hosting phishing sites.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Free file host, Free subdomain host, IPFS |
Event coverage
Rule body MQL
type.inbound
and any(body.links,
// Any body link domains contain "ipfs"
(
strings.icontains(.href_url.domain.domain, "ipfs")
and not .href_url.domain.root_domain == "ipfs.com"
)
// Or the path contains ipfs anchored to a leading and trailing '-', '/', '.'
or (
regex.icontains(.href_url.query_params, '[\.-/]ipfs[\.-/]')
and .href_url.domain.domain not in $org_domains
and (
(
// don't include high rep domains
.href_url.domain.domain not in $tranco_1m
and .href_url.domain.domain not in $umbrella_1m
)
// if it's in Tranco or Umbrella, still include it if it's one of these
or .href_url.domain.domain in $free_file_hosts
or .href_url.domain.root_domain in $free_file_hosts
or .href_url.domain.root_domain in $free_subdomain_hosts
)
)
)
// adding negation block for legitimate domains with ipfs in their name
and not sender.email.domain.domain in ("shipfsl.com")
// negate ipfs.com issues
and not any(recipients.to, .email.domain.domain == "ipfs.com")
and not (
sender.email.domain.root_domain is not null
and sender.email.domain.root_domain == "ipfs.com"
and headers.auth_summary.dmarc.pass
)
and (
not profile.by_sender().solicited
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
Detects messages containing links that have 'ipfs' in the domain, or unanalyzed links that contain 'ipfs' in the url. IPFS has been recently observed hosting phishing sites.
- inbound message
any of
body.linkswhere any holds:all of:
- .href_url.domain.domain contains 'ipfs'
not:
- .href_url.domain.root_domain is 'ipfs.com'
all of:
- .href_url.query_params matches '[\\.-/]ipfs[\\.-/]'
- .href_url.domain.domain not in $org_domains
any of:
all of:
- .href_url.domain.domain not in $tranco_1m
- .href_url.domain.domain not in $umbrella_1m
- .href_url.domain.domain in $free_file_hosts
- .href_url.domain.root_domain in $free_file_hosts
- .href_url.domain.root_domain in $free_subdomain_hosts
not:
- sender.email.domain.domain in ('shipfsl.com')
not:
any of
recipients.towhere:- .email.domain.domain is 'ipfs.com'
not:
all of:
- sender.email.domain.root_domain is set
- sender.email.domain.root_domain is 'ipfs.com'
- headers.auth_summary.dmarc.pass
any of:
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
not:
- profile.by_sender().any_messages_benign
Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.query_params, headers.auth_summary.dmarc.pass, recipients.to, recipients.to[].email.domain.domain, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender, regex.icontains, strings.icontains. Reference lists: $free_file_hosts, $free_subdomain_hosts, $org_domains, $tranco_1m, $umbrella_1m.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | ipfs |
body.links[].href_url.domain.root_domain | equals | ipfs.com |
regex.icontains | regex | [\.-/]ipfs[\.-/] |
sender.email.domain.domain | member | shipfsl.com |
recipients.to[].email.domain.domain | equals | ipfs.com |
sender.email.domain.root_domain | equals | ipfs.com |