Detection rules › Sublime MQL

Link: Multistage landing - JotForm abuse

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects a disabled JotForm that contains suspicious elements like secured document messaging, cloned forms, or suspicious action words in form items. Also checks for human verification pages and embedded links to credential collection sites.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Social engineering

Event coverage

Rule body MQL

type.inbound
and length(filter(body.links, .href_url.domain.root_domain == "jotform.com")) > 0
and any(filter(body.links, .href_url.domain.root_domain == "jotform.com"),
        // the form as been disabled
        strings.icontains(ml.link_analysis(.).final_dom.inner_text,
                          'This form is disabled...'
        )
        // lure to open a document with phishing intent
        or (
          any(ml.link_analysis(.).final_dom.links,
              regex.icontains(.display_text, "VIEW DOCUMENT ONLINE")
              and ml.link_analysis(.href_url).credphish.disposition == "phishing"
          )
        )
        // it contains suspicious elements within the extracted "appInfo"
        or any(regex.iextract(ml.link_analysis(.).final_dom.raw,
                              'window\.__appInfo = (?P<appInfo>\{[^\n]+\})\;\n'
               ),
               // the title/description/name contains suspicious keywords
               any([
                     strings.parse_json(.named_groups["appInfo"])["title"],
                     strings.parse_json(.named_groups["appInfo"])["description"],
                     strings.parse_json(.named_groups["appInfo"])["name"]
                   ],
                   strings.icontains(., 'secured document')
                   or strings.icontains(., 'Adobe PDF')
               )
               or any(strings.parse_json(.named_groups["appInfo"])["items"],
                      // find any links that mention common "action" words
                      any([.["description"], .["title"]],
                          regex.icontains(.,
                                          '(?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account)'
                          )
                      )

                      // inspect the linked page within the "buttonValue" or .title contains a link
                      or (
                        any([.["buttonValue"], .["title"]],
                            strings.icontains(., 'http')
                            and (
                              ml.link_analysis(strings.parse_url(.)).credphish.disposition == "phishing"
                              or ml.link_analysis(strings.parse_url(.)).credphish.contains_captcha == true
                              or strings.istarts_with(ml.link_analysis(strings.parse_url(.
                                                                       )
                                                      ).final_dom.inner_text,
                                                      'Verify you are human'
                              )
                            )
                        )
                      )
               )
        )
)

Detection logic

Scope: inbound message.

Detects a disabled JotForm that contains suspicious elements like secured document messaging, cloned forms, or suspicious action words in form items. Also checks for human verification pages and embedded links to credential collection sites.

  1. inbound message
  2. length(filter(body.links, .href_url.domain.root_domain == 'jotform.com')) > 0
  3. any of filter(body.links) where any holds:
    • ml.link_analysis(.).final_dom.inner_text contains 'This form is disabled...'
    • any of ml.link_analysis(.).final_dom.links where all hold:
      • .display_text matches 'VIEW DOCUMENT ONLINE'
      • ml.link_analysis(.href_url).credphish.disposition is 'phishing'
    • any of regex.iextract(...) where any holds:
      • any of [strings.parse_json(.named_groups['appInfo'])['title'], strings.parse_json(.named_groups['appInfo'])['description'], strings.parse_json(.named_groups['appInfo'])['name']] where any holds:
        • . contains 'secured document'
        • . contains 'Adobe PDF'
      • any of strings.parse_json(.named_groups['appInfo'])['items'] where any holds:
        • any of [.['description'], .['title']] where:
          • . matches '(?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account)'
        • any of [.['buttonValue'], .['title']] where all hold:
          • . contains 'http'
          • any of:
            • ml.link_analysis(strings.parse_url(.)).credphish.disposition is 'phishing'
            • ml.link_analysis(strings.parse_url(.)).credphish.contains_captcha is True
            • ml.link_analysis(strings.parse_url(.)).final_dom.inner_text starts with 'Verify you are human'

Inspects: body.links, body.links[].href_url.domain.root_domain, type.inbound. Sensors: ml.link_analysis, regex.icontains, regex.iextract, strings.icontains, strings.istarts_with, strings.parse_json, strings.parse_url.

Indicators matched (9)

FieldMatchValue
body.links[].href_url.domain.root_domainequalsjotform.com
strings.icontainssubstringThis form is disabled...
regex.icontainsregexVIEW DOCUMENT ONLINE
regex.iextractregexwindow\.__appInfo = (?P<appInfo>\{[^\n]+\})\;\n
strings.icontainssubstringsecured document
strings.icontainssubstringAdobe PDF
regex.icontainsregex(?:view|click|show|access|download|goto|Validate|Va[il]idar|login|verify|account)
strings.icontainssubstringhttp
strings.istarts_withprefixVerify you are human