Detection rules › Sublime MQL
Link: Multistage landing - JotForm abuse
Detects a disabled JotForm that contains suspicious elements like secured document messaging, cloned forms, or suspicious action words in form items. Also checks for human verification pages and embedded links to credential collection sites.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and length(filter(body.links, .href_url.domain.root_domain == "jotform.com")) > 0
and any(filter(body.links, .href_url.domain.root_domain == "jotform.com"),
// the form as been disabled
strings.icontains(ml.link_analysis(.).final_dom.inner_text,
'This form is disabled...'
)
// lure to open a document with phishing intent
or (
any(ml.link_analysis(.).final_dom.links,
regex.icontains(.display_text, "VIEW DOCUMENT ONLINE")
and ml.link_analysis(.href_url).credphish.disposition == "phishing"
)
)
// it contains suspicious elements within the extracted "appInfo"
or any(regex.iextract(ml.link_analysis(.).final_dom.raw,
'window\.__appInfo = (?P<appInfo>\{[^\n]+\})\;\n'
),
// the title/description/name contains suspicious keywords
any([
strings.parse_json(.named_groups["appInfo"])["title"],
strings.parse_json(.named_groups["appInfo"])["description"],
strings.parse_json(.named_groups["appInfo"])["name"]
],
strings.icontains(., 'secured document')
or strings.icontains(., 'Adobe PDF')
)
or any(strings.parse_json(.named_groups["appInfo"])["items"],
// find any links that mention common "action" words
any([.["description"], .["title"]],
regex.icontains(.,
'(?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account)'
)
)
// inspect the linked page within the "buttonValue" or .title contains a link
or (
any([.["buttonValue"], .["title"]],
strings.icontains(., 'http')
and (
ml.link_analysis(strings.parse_url(.)).credphish.disposition == "phishing"
or ml.link_analysis(strings.parse_url(.)).credphish.contains_captcha == true
or strings.istarts_with(ml.link_analysis(strings.parse_url(.
)
).final_dom.inner_text,
'Verify you are human'
)
)
)
)
)
)
)
Detection logic
Scope: inbound message.
Detects a disabled JotForm that contains suspicious elements like secured document messaging, cloned forms, or suspicious action words in form items. Also checks for human verification pages and embedded links to credential collection sites.
- inbound message
- length(filter(body.links, .href_url.domain.root_domain == 'jotform.com')) > 0
any of
filter(body.links)where any holds:- ml.link_analysis(.).final_dom.inner_text contains 'This form is disabled...'
any of
ml.link_analysis(.).final_dom.linkswhere all hold:- .display_text matches 'VIEW DOCUMENT ONLINE'
- ml.link_analysis(.href_url).credphish.disposition is 'phishing'
any of
regex.iextract(...)where any holds:any of
[strings.parse_json(.named_groups['appInfo'])['title'], strings.parse_json(.named_groups['appInfo'])['description'], strings.parse_json(.named_groups['appInfo'])['name']]where any holds:- . contains 'secured document'
- . contains 'Adobe PDF'
any of
strings.parse_json(.named_groups['appInfo'])['items']where any holds:any of
[.['description'], .['title']]where:- . matches '(?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account)'
any of
[.['buttonValue'], .['title']]where all hold:- . contains 'http'
any of:
- ml.link_analysis(strings.parse_url(.)).credphish.disposition is 'phishing'
- ml.link_analysis(strings.parse_url(.)).credphish.contains_captcha is True
- ml.link_analysis(strings.parse_url(.)).final_dom.inner_text starts with 'Verify you are human'
Inspects: body.links, body.links[].href_url.domain.root_domain, type.inbound. Sensors: ml.link_analysis, regex.icontains, regex.iextract, strings.icontains, strings.istarts_with, strings.parse_json, strings.parse_url.
Indicators matched (9)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | jotform.com |
strings.icontains | substring | This form is disabled... |
regex.icontains | regex | VIEW DOCUMENT ONLINE |
regex.iextract | regex | window\.__appInfo = (?P<appInfo>\{[^\n]+\})\;\n |
strings.icontains | substring | secured document |
strings.icontains | substring | Adobe PDF |
regex.icontains | regex | (?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account) |
strings.icontains | substring | http |
strings.istarts_with | prefix | Verify you are human |