Detection rules › Sublime MQL
Open redirect (go2.aspx) leading to Microsoft credential phishing
This rule is designed to detect credential phishing attacks that exploit go2.aspx redirects and masquerade as Microsoft-related emails.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Open redirect |
Event coverage
| Message attribute |
|---|
| body |
| body.html |
| body.links (collection) |
| headers (collection) |
| type |
Rule body MQL
type.inbound
// url path ends with go2.aspx
and any(body.links,
strings.ends_with(.href_url.path, "go2.aspx")
// query params from href_url or ml.link_analysis contain a redirection string ending with a base64
// pattern intended to capture an encoded email passed as an additional parameter
and (
regex.contains(.href_url.query_params,
'[a-z]=[a-z0-9-]+\.[a-z]{2,3}.+[A-Za-z0-9+/=]$|=[^=]$|={3,}$'
)
or regex.icontains(ml.link_analysis(.).effective_url.query_params,
'[a-z]=[a-z0-9-]+\.[a-z]{2,3}.+[A-Za-z0-9+/=]$|=[^=]$|={3,}$'
)
)
)
and headers.mailer is null
and regex.icontains(body.html.inner_text,
'(i\x{034F}c\x{034F}r\x{034F}os\x{034F}of\x{034F}|icrosof)|(office|o)\s?365'
)
Detection logic
Scope: inbound message.
This rule is designed to detect credential phishing attacks that exploit go2.aspx redirects and masquerade as Microsoft-related emails.
- inbound message
any of
body.linkswhere all hold:- .href_url.path ends with 'go2.aspx'
any of:
- .href_url.query_params matches '[a-z]=[a-z0-9-]+\\.[a-z]{2,3}.+[A-Za-z0-9+/=]$|=[^=]$|={3,}$'
- ml.link_analysis(.).effective_url.query_params matches '[a-z]=[a-z0-9-]+\\.[a-z]{2,3}.+[A-Za-z0-9+/=]$|=[^=]$|={3,}$'
- headers.mailer is missing
- body.html.inner_text matches '(i\\x{034F}c\\x{034F}r\\x{034F}os\\x{034F}of\\x{034F}|icrosof)|(office|o)\\s?365'
Inspects: body.html.inner_text, body.links, body.links[].href_url.path, body.links[].href_url.query_params, headers.mailer, type.inbound. Sensors: ml.link_analysis, regex.contains, regex.icontains, strings.ends_with.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
strings.ends_with | suffix | go2.aspx |
regex.contains | regex | [a-z]=[a-z0-9-]+\.[a-z]{2,3}.+[A-Za-z0-9+/=]$|=[^=]$|={3,}$ |
regex.icontains | regex | [a-z]=[a-z0-9-]+\.[a-z]{2,3}.+[A-Za-z0-9+/=]$|=[^=]$|={3,}$ |
regex.icontains | regex | (i\x{034F}c\x{034F}r\x{034F}os\x{034F}of\x{034F}|icrosof)|(office|o)\s?365 |