Detection rules › Sublime MQL
Link: Multistage landing - FreshDesk knowledge base abuse
Detects messages containing links to Freshdesk support solution pages that redirect to external domains with credential theft language, excluding legitimate Freshworks domains and organizational domains.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Open redirect, Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
and length(body.links) < 10
and any(filter(body.links,
.href_url.domain.root_domain == "freshdesk.com"
and strings.icontains(.href_url.path, 'support/solutions')
),
// link to unknown domain on the page
length(filter(ml.link_analysis(.).final_dom.links,
.href_url.domain.root_domain not in ("freshworks.com")
and .href_url.domain.root_domain not in $org_domains
and .href_url.domain.root_domain != sender.email.domain.root_domain
)
) < 3
// cred theft language on the page
and any(ml.nlu_classifier(ml.link_analysis(.).final_dom.display_text).intents,
.name == "cred_theft" and .confidence != "low"
)
)
Detection logic
Scope: inbound message.
Detects messages containing links to Freshdesk support solution pages that redirect to external domains with credential theft language, excluding legitimate Freshworks domains and organizational domains.
- inbound message
- length(body.links) < 10
any of
filter(body.links)where all hold:- length(filter(ml.link_analysis(.).final_dom.links, .href_url.domain.root_domain not in ('freshworks.com') and .href_url.domain.root_domain not in $org_domains and .href_url.domain.root_domain != sender.email.domain.root_domain)) < 3
any of
ml.nlu_classifier(ml.link_analysis(.).final_dom.display_text).intentswhere all hold:- .name is 'cred_theft'
- .confidence is not 'low'
Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, sender.email.domain.root_domain, type.inbound. Sensors: ml.link_analysis, ml.nlu_classifier, strings.icontains. Reference lists: $org_domains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | freshdesk.com |
strings.icontains | substring | support/solutions |
ml.link_analysis(filter(body.links)[]).final_dom.links[].href_url.domain.root_domain | member | freshworks.com |
ml.nlu_classifier(ml.link_analysis(filter(body.links)[]).final_dom.display_text).intents[].name | equals | cred_theft |