Detection rules › Sublime MQL
Link: Direct link to keap.app contact-us page
Detects URLs linking to Keap App contact us, which has been used to host malicious content due to its trusted domain status and product capabilities
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Free file host, Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and length(body.links) < 10
and any(body.links,
(
.href_url.domain.root_domain == "keap.app"
and strings.istarts_with(.href_url.path, '/contact-us/')
)
// encoded within the query_params (common for open redirects)
or (
(
strings.icontains(.href_url.query_params, 'keap.app')
or strings.icontains(.href_url.query_params, 'keap%2eapp')
or strings.icontains(.href_url.query_params, 'keap%252eapp')
)
and strings.istarts_with(.href_url.query_params, '/contact-us/')
)
)
and length(filter(body.links,
.href_url.domain.root_domain == "keap.app"
// encoded within the query_params (common for open redirects)
or strings.icontains(.href_url.query_params, 'keap.app')
or strings.icontains(.href_url.query_params, 'keap%2eapp')
or strings.icontains(.href_url.query_params, 'keap%252eapp')
)
) == 1
Detection logic
Scope: inbound message.
Detects URLs linking to Keap App contact us, which has been used to host malicious content due to its trusted domain status and product capabilities
- inbound message
- length(body.links) < 10
any of
body.linkswhere any holds:all of:
- .href_url.domain.root_domain is 'keap.app'
- .href_url.path starts with '/contact-us/'
all of:
any of:
- .href_url.query_params contains 'keap.app'
- .href_url.query_params contains 'keap%2eapp'
- .href_url.query_params contains 'keap%252eapp'
- .href_url.query_params starts with '/contact-us/'
- length(filter(body.links, .href_url.domain.root_domain == 'keap.app' or strings.icontains(.href_url.query_params, 'keap.app') or strings.icontains(.href_url.query_params, 'keap%2eapp') or strings.icontains(.href_url.query_params, 'keap%252eapp'))) is 1
Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, body.links[].href_url.query_params, type.inbound. Sensors: strings.icontains, strings.istarts_with.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | keap.app |
strings.istarts_with | prefix | /contact-us/ |
strings.icontains | substring | keap.app |
strings.icontains | substring | keap%2eapp |
strings.icontains | substring | keap%252eapp |