Detection rules › Sublime MQL
Link: Direct link to limewire hosted file
Message contains exactly one link to limewire.com domain with fewer than 10 total links in the body.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Free file host |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
// there are few links
and length(body.links) < 10
// contains a link to limewire
and any(body.links, .href_url.domain.domain == "limewire.com")
// is the only link to limewire
and length(filter(body.links,
.href_url.domain.root_domain == "limewire.com"
and strings.istarts_with(.href_url.path, "/d/")
)
) == 1
and not length(body.previous_threads) > 0
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender_email().any_messages_benign
Detection logic
Scope: inbound message.
Message contains exactly one link to limewire.com domain with fewer than 10 total links in the body.
- inbound message
- length(body.links) < 10
any of
body.linkswhere:- .href_url.domain.domain is 'limewire.com'
- length(filter(body.links, .href_url.domain.root_domain == 'limewire.com' and strings.istarts_with(.href_url.path, '/d/'))) is 1
not:
- length(body.previous_threads) > 0
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
not:
- profile.by_sender_email().any_messages_benign
Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.path, body.previous_threads, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender_email, strings.istarts_with. Reference lists: $high_trust_sender_root_domains.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.domain | equals | limewire.com |
body.links[].href_url.domain.root_domain | equals | limewire.com |
strings.istarts_with | prefix | /d/ |