Detection rules › Sublime MQL

Link: Multistage landing - FreshDesk knowledge base abuse

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing links to Freshdesk support solution pages that redirect to external domains with credential theft language, excluding legitimate Freshworks domains and organizational domains.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesOpen redirect, Impersonation: Brand, Social engineering

Event coverage

Rule body MQL

type.inbound
and length(body.links) < 10
and any(filter(body.links,
               .href_url.domain.root_domain == "freshdesk.com"
               and strings.icontains(.href_url.path, 'support/solutions')
        ),
        // link to unknown domain on the page
        length(filter(ml.link_analysis(.).final_dom.links,
                      .href_url.domain.root_domain not in ("freshworks.com")
                      and .href_url.domain.root_domain not in $org_domains
                      and .href_url.domain.root_domain != sender.email.domain.root_domain
               )
        ) < 3
        // cred theft language on the page
        and any(ml.nlu_classifier(ml.link_analysis(.).final_dom.display_text).intents,
                .name == "cred_theft" and .confidence != "low"
        )
)

Detection logic

Scope: inbound message.

Detects messages containing links to Freshdesk support solution pages that redirect to external domains with credential theft language, excluding legitimate Freshworks domains and organizational domains.

  1. inbound message
  2. length(body.links) < 10
  3. any of filter(body.links) where all hold:
    • length(filter(ml.link_analysis(.).final_dom.links, .href_url.domain.root_domain not in ('freshworks.com') and .href_url.domain.root_domain not in $org_domains and .href_url.domain.root_domain != sender.email.domain.root_domain)) < 3
    • any of ml.nlu_classifier(ml.link_analysis(.).final_dom.display_text).intents where all hold:
      • .name is 'cred_theft'
      • .confidence is not 'low'

Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, sender.email.domain.root_domain, type.inbound. Sensors: ml.link_analysis, ml.nlu_classifier, strings.icontains. Reference lists: $org_domains.

Indicators matched (4)

FieldMatchValue
body.links[].href_url.domain.root_domainequalsfreshdesk.com
strings.icontainssubstringsupport/solutions
ml.link_analysis(filter(body.links)[]).final_dom.links[].href_url.domain.root_domainmemberfreshworks.com
ml.nlu_classifier(ml.link_analysis(filter(body.links)[]).final_dom.display_text).intents[].nameequalscred_theft