detection.wiki

Detection rules › Sublime MQL

Link: Suspicious Loom HTML file path

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages containing links to Loom HTML files, which may be used to deliver malicious content or bypass security controls through the legitimate Loom platform.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, Social engineering

Event coverage

Message attribute
body.current_thread
type

Rule body MQL

type.inbound
and any(body.current_thread.links,
        regex.imatch(.href_url.path, '/loom/[^\/]+\.html')
)

Detection logic

Scope: inbound message.

Detects inbound messages containing links to Loom HTML files, which may be used to deliver malicious content or bypass security controls through the legitimate Loom platform.

  1. inbound message
  2. any of body.current_thread.links where:
    • .href_url.path matches '/loom/[^\\/]+\\.html'

Inspects: body.current_thread.links, body.current_thread.links[].href_url.path, type.inbound. Sensors: regex.imatch.

Indicators matched (1)

FieldMatchValue
regex.imatchregex/loom/[^\/]+\.html