Detection rules › Sublime MQL

Link: Direct link to keap.app contact-us page

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects URLs linking to Keap App contact us, which has been used to host malicious content due to its trusted domain status and product capabilities

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesFree file host, Evasion

Event coverage

Rule body MQL

type.inbound
and length(body.links) < 10
and any(body.links,
        (
          .href_url.domain.root_domain == "keap.app"
          and strings.istarts_with(.href_url.path, '/contact-us/')
        )
        // encoded within the query_params (common for open redirects)
        or (
          (
            strings.icontains(.href_url.query_params, 'keap.app')
            or strings.icontains(.href_url.query_params, 'keap%2eapp')
            or strings.icontains(.href_url.query_params, 'keap%252eapp')
          )
          and strings.istarts_with(.href_url.query_params, '/contact-us/')
        )
)
and length(filter(body.links,
                  .href_url.domain.root_domain == "keap.app"
                  // encoded within the query_params (common for open redirects)
                  or strings.icontains(.href_url.query_params, 'keap.app')
                  or strings.icontains(.href_url.query_params, 'keap%2eapp')
                  or strings.icontains(.href_url.query_params, 'keap%252eapp')
           )
) == 1

Detection logic

Scope: inbound message.

Detects URLs linking to Keap App contact us, which has been used to host malicious content due to its trusted domain status and product capabilities

  1. inbound message
  2. length(body.links) < 10
  3. any of body.links where any holds:
    • all of:
      • .href_url.domain.root_domain is 'keap.app'
      • .href_url.path starts with '/contact-us/'
    • all of:
      • any of:
        • .href_url.query_params contains 'keap.app'
        • .href_url.query_params contains 'keap%2eapp'
        • .href_url.query_params contains 'keap%252eapp'
      • .href_url.query_params starts with '/contact-us/'
  4. length(filter(body.links, .href_url.domain.root_domain == 'keap.app' or strings.icontains(.href_url.query_params, 'keap.app') or strings.icontains(.href_url.query_params, 'keap%2eapp') or strings.icontains(.href_url.query_params, 'keap%252eapp'))) is 1

Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, body.links[].href_url.query_params, type.inbound. Sensors: strings.icontains, strings.istarts_with.

Indicators matched (5)

FieldMatchValue
body.links[].href_url.domain.root_domainequalskeap.app
strings.istarts_withprefix/contact-us/
strings.icontainssubstringkeap.app
strings.icontainssubstringkeap%2eapp
strings.icontainssubstringkeap%252eapp