detection.wiki

Detection rules › Sublime MQL

Link: JavaScript obfuscation with Telegram bot integration

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects links containing obfuscated JavaScript code with embedded Telegram bot tokens or API references, indicating potential data exfiltration or command and control infrastructure.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Scripting

Event coverage

Message attribute
body
recipients
recipients.to (collection)
type

Rule body MQL

type.inbound
and 0 < length(body.links) < 15
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(body.links,
        // javascript obfuscator code - https://obfuscator.io/
        regex.icontains(ml.link_analysis(.).final_dom.raw,
                        '(?:(?:return|function|var|let|const|parseInt)\(?\s*_0x[a-f0-9]{6}.{0,50}){5}'
        )
        and regex.icontains(ml.link_analysis(.).final_dom.raw,
                            // telegram bot token struct
                            '[\x22\x27][0-9]{10}:[a-z0-9_-]{20,35}[\x22\x27]',
                            // telegram strings
                            '(?:telegram(?:chatid|BotToken)|TELEGRAM_(?:BOT_TOKENS|CHAT_IDS)|api\.telegram\.org/bot|telegramToken)'
        )
)

Detection logic

Scope: inbound message.

Detects links containing obfuscated JavaScript code with embedded Telegram bot tokens or API references, indicating potential data exfiltration or command and control infrastructure.

  1. inbound message
  2. all of:
    • length(body.links) > 0
    • length(body.links) < 15
  3. length(recipients.to) is 1
  4. recipients.to[0].email.domain.valid
  5. any of body.links where all hold:
    • ml.link_analysis(.).final_dom.raw matches '(?:(?:return|function|var|let|const|parseInt)\\(?\\s*_0x[a-f0-9]{6}.{0,50}){5}'
    • ml.link_analysis(.).final_dom.raw matches any of 2 patterns
      • [\x22\x27][0-9]{10}:[a-z0-9_-]{20,35}[\x22\x27]
      • (?:telegram(?:chatid|BotToken)|TELEGRAM_(?:BOT_TOKENS|CHAT_IDS)|api\.telegram\.org/bot|telegramToken)

Inspects: body.links, recipients.to, recipients.to[0].email.domain.valid, type.inbound. Sensors: ml.link_analysis, regex.icontains.

Indicators matched (3)

FieldMatchValue
regex.icontainsregex(?:(?:return|function|var|let|const|parseInt)\(?\s*_0x[a-f0-9]{6}.{0,50}){5}
regex.icontainsregex[\x22\x27][0-9]{10}:[a-z0-9_-]{20,35}[\x22\x27]
regex.icontainsregex(?:telegram(?:chatid|BotToken)|TELEGRAM_(?:BOT_TOKENS|CHAT_IDS)|api\.telegram\.org/bot|telegramToken)