detection.wiki

Detection rules › Sublime MQL

New link domain (<=10d) from untrusted sender

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects links in the body of an email where the linked domain is less than 10 days old from untrusted senders.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware

Event coverage

Message attribute
body
body.links (collection)
type

Rule body MQL

type.inbound
and length(body.links) > 0
and any(body.links, network.whois(.href_url.domain).days_old <= 10)
and (
  (
    profile.by_sender().prevalence in ("new", "outlier")
    and not profile.by_sender().solicited
  )
  or profile.by_sender().any_messages_malicious_or_spam
)
// negate senders which have had previous messages marked as benign which pass auth
and not (
  profile.by_sender().any_messages_benign
  and profile.by_sender().auth_failed == false
)

Detection logic

Scope: inbound message.

Detects links in the body of an email where the linked domain is less than 10 days old from untrusted senders.

  1. inbound message
  2. length(body.links) > 0
  3. any of body.links where:
    • network.whois(.href_url.domain).days_old ≤ 10
  4. any of:
    • all of:
      • profile.by_sender().prevalence in ('new', 'outlier')
      • not:
        • profile.by_sender().solicited
    • profile.by_sender().any_messages_malicious_or_spam
  5. not:
    • all of:
      • profile.by_sender().any_messages_benign
      • profile.by_sender().auth_failed is False

Inspects: body.links, body.links[].href_url.domain, type.inbound. Sensors: network.whois, profile.by_sender.