Detection rules › Sublime MQL
Notion suspicious file share
Message contains a notion link that contains suspicious terms. You may need to deactivate or fork this rule if your organization uses Notion.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion, Free file host |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
and any(body.links,
.href_url.domain.root_domain in~ ("notion.so", "notion.site")
and (
strings.ilike(.href_url.url,
'*shared*',
'*document*',
'*secure*',
'*office*',
'*important*',
'*wants-to*',
'*share*',
'*statement*'
)
or strings.ilike(.display_url.url,
'*shared*',
'*document*',
'*secure*',
'*office*',
'*important*',
'*wants-to*',
'*share*',
'*statement*'
)
or strings.ilike(.display_text,
'*shared*',
'*document*',
'*secure*',
'*office*',
'*important*',
'*wants-to*',
'*share*',
'*statement*'
)
)
)
and sender.email.domain.domain != 'mail.notion.so'
and (
profile.by_sender().prevalence in ("new", "outlier")
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
Detection logic
Scope: inbound message.
Message contains a notion link that contains suspicious terms. You may need to deactivate or fork this rule if your organization uses Notion.
- inbound message
any of
body.linkswhere all hold:- .href_url.domain.root_domain in ('notion.so', 'notion.site')
any of:
.href_url.url matches any of 8 patterns
*shared**document**secure**office**important**wants-to**share**statement*
.display_url.url matches any of 8 patterns
*shared**document**secure**office**important**wants-to**share**statement*
.display_text matches any of 8 patterns
*shared**document**secure**office**important**wants-to**share**statement*
- sender.email.domain.domain is not 'mail.notion.so'
any of:
- profile.by_sender().prevalence in ('new', 'outlier')
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
Inspects: body.links, body.links[].display_text, body.links[].display_url.url, body.links[].href_url.domain.root_domain, body.links[].href_url.url, sender.email.domain.domain, type.inbound. Sensors: profile.by_sender, strings.ilike.
Indicators matched (10)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | member | notion.so |
body.links[].href_url.domain.root_domain | member | notion.site |
strings.ilike | substring | *shared* |
strings.ilike | substring | *document* |
strings.ilike | substring | *secure* |
strings.ilike | substring | *office* |
strings.ilike | substring | *important* |
strings.ilike | substring | *wants-to* |
strings.ilike | substring | *share* |
strings.ilike | substring | *statement* |