detection.wiki

Detection rules › Sublime MQL

Link: Multistage landing - ClickUp abuse

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects ClickUp documents that contain external links to suspicious domains including new domains, free file hosts, URL shorteners, or links that redirect to phishing pages or contain captchas.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesEvasion, Free file host, Free subdomain host, Open redirect

Event coverage

Message attribute
body.current_thread
type

Rule body MQL

type.inbound
and any(body.current_thread.links,
        .href_url.domain.domain == "doc.clickup.com"
        and (
          // landing page has been removed
          strings.istarts_with(ml.link_analysis(.).final_dom.display_text,
                               'This page is currently unavailable'
          )
          // inspection of links within the doc.clickup.com
          or any(filter(ml.link_analysis(.).final_dom.links,
                        .href_url.domain.root_domain != 'clickup.com'
                        and .href_url.domain.root_domain not in $org_domains
                 ),
                 (
                   // any of those links domains are new
                   network.whois(.href_url.domain).days_old < 30
                   // go to free file hosts
                   or .href_url.domain.root_domain in $free_file_hosts
                   or .href_url.domain.domain in $free_file_hosts

                   // go to free subdomains hosts
                   or (
                     .href_url.domain.root_domain in $free_subdomain_hosts
                     // where there is a subdomain
                     and .href_url.domain.subdomain is not null
                     and .href_url.domain.subdomain != "www"
                   )
                   // go to url shorteners
                   or .href_url.domain.root_domain in $url_shorteners
                   or .href_url.domain.root_domain in $social_landing_hosts
                   or .href_url.domain.domain in $url_shorteners
                   or .href_url.domain.domain in $social_landing_hosts
                   // or the page has been taken down
                   or (
                     // find any links that mention common "action" words
                     regex.icontains(.display_text,
                                     '(?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account)'
                     )
                     and (
                       // and when visiting those links, are phishing
                       ml.link_analysis(., mode="aggressive").credphish.disposition == "phishing"

                       // hit a captcha page
                       or ml.link_analysis(., mode="aggressive").credphish.contains_captcha

                       // or the page redirects to common website, observed when evasion happens
                       or (
                         length(ml.link_analysis(., mode="aggressive").redirect_history
                         ) > 0
                         and ml.link_analysis(., mode="aggressive").effective_url.domain.root_domain in $tranco_10k
                       )
                     )
                   )
                 )
          )
        )
)

Detection logic

Scope: inbound message.

Detects ClickUp documents that contain external links to suspicious domains including new domains, free file hosts, URL shorteners, or links that redirect to phishing pages or contain captchas.

  1. inbound message
  2. any of body.current_thread.links where all hold:
    • .href_url.domain.domain is 'doc.clickup.com'
    • any of:
      • ml.link_analysis(.).final_dom.display_text starts with 'This page is currently unavailable'
      • any of filter(...) where any holds:
        • network.whois(.href_url.domain).days_old < 30
        • .href_url.domain.root_domain in $free_file_hosts
        • .href_url.domain.domain in $free_file_hosts
        • all of:
          • .href_url.domain.root_domain in $free_subdomain_hosts
          • .href_url.domain.subdomain is set
          • .href_url.domain.subdomain is not 'www'
        • .href_url.domain.root_domain in $url_shorteners
        • .href_url.domain.root_domain in $social_landing_hosts
        • .href_url.domain.domain in $url_shorteners
        • .href_url.domain.domain in $social_landing_hosts
        • all of:
          • .display_text matches '(?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account)'
          • any of:
            • ml.link_analysis(.).credphish.disposition is 'phishing'
            • ml.link_analysis(.).credphish.contains_captcha
            • all of:
              • length(ml.link_analysis(., mode='aggressive').redirect_history) > 0
              • ml.link_analysis(.).effective_url.domain.root_domain in $tranco_10k

Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.domain, type.inbound. Sensors: ml.link_analysis, network.whois, regex.icontains, strings.istarts_with. Reference lists: $free_file_hosts, $free_subdomain_hosts, $org_domains, $social_landing_hosts, $tranco_10k, $url_shorteners.

Indicators matched (3)

FieldMatchValue
body.current_thread.links[].href_url.domain.domainequalsdoc.clickup.com
strings.istarts_withprefixThis page is currently unavailable
regex.icontainsregex(?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account)