detection.wiki

Detection rules › Sublime MQL

Link: Multistage landing - Published Google Doc

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

A Google Docs document contains suspicious text and links that redirect to either newly registered domains, free subdomain hosts, URL shorteners, or domains with suspicious TLDs.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesFree file host, Social engineering

Event coverage

Message attribute
body
body.links (collection)
headers (collection)
headers.reply_to (collection)
sender.email
type

Rule body MQL

type.inbound
and not sender.email.domain.domain == "google.com"
and length(distinct(filter(body.links,
                           .href_url.domain.domain == "docs.google.com"
                    ),
                    .href_url.url
           )
) < 3
and any(filter(body.links,
               .href_url.domain.domain == "docs.google.com"
               and (
                 any(ml.nlu_classifier(.display_text).entities,
                     .name == "request"
                 )
                 or any(ml.nlu_classifier(.display_text).intents,
                        .name == "cred_theft"
                 )
               )
        ),
        strings.istarts_with(ml.link_analysis(., mode="aggressive").final_dom.display_text,
                             "Published using Google Docs"
        )
        // filter down to links in the document where the display text is suspicious
        and any(filter(ml.link_analysis(., mode="aggressive").final_dom.links,
                       any(ml.nlu_classifier(.display_text).entities,
                           .name == "request"
                       )
                       or any(ml.nlu_classifier(.display_text).intents,
                              .name == "cred_theft"
                       )
                ),
                (
                  // any of those links domains are new
                  network.whois(.href_url.domain).days_old < 30

                  // go to free subdomains hosts
                  or (
                    .href_url.domain.root_domain in $free_subdomain_hosts
                    // where there is a subdomain
                    and .href_url.domain.subdomain is not null
                    and .href_url.domain.subdomain != "www"
                  )
                  // go to url shortners
                  or .href_url.domain.root_domain in $url_shorteners
                  or .href_url.domain.root_domain in $social_landing_hosts
                  or .href_url.domain.domain in $url_shorteners
                  or .href_url.domain.domain in $social_landing_hosts

                  // go to suspicious TLDs
                  or .href_url.domain.tld in $suspicious_tlds

                  // check for a second stage website that contains a suspicious link
                  // in other words, this LA call is inspecting links in sites on the Google Doc page
                  // we have seen Google Docs -> Google Slides (which this call is inspecting) -> malicious site
                  or any(ml.link_analysis(.href_url).final_dom.links,
                         .href_url.domain.root_domain in $free_file_hosts
                         or .href_url.domain.domain in $free_file_hosts
                         or (
                           .href_url.domain.root_domain in $free_subdomain_hosts
                           // where there is a subdomain
                           and .href_url.domain.subdomain is not null
                           and .href_url.domain.subdomain != "www"
                         )
                         or .href_url.domain.root_domain in $url_shorteners
                         or .href_url.domain.root_domain in $social_landing_hosts
                         or .href_url.domain.domain in $url_shorteners
                         or .href_url.domain.domain in $social_landing_hosts

                         // go to suspicious TLDs
                         or .href_url.domain.tld in $suspicious_tlds
                  )
                )
        )
)
and not (
  length(headers.reply_to) == 1
  and all(headers.reply_to, .email.domain.domain in $org_domains)
)

Detection logic

Scope: inbound message.

A Google Docs document contains suspicious text and links that redirect to either newly registered domains, free subdomain hosts, URL shorteners, or domains with suspicious TLDs.

  1. inbound message
  2. not:
    • sender.email.domain.domain is 'google.com'
  3. length(distinct(filter(body.links, .href_url.domain.domain == 'docs.google.com'), .href_url.url)) < 3
  4. any of filter(body.links) where all hold:
    • ml.link_analysis(., mode='aggressive').final_dom.display_text starts with 'Published using Google Docs'
    • any of filter(...) where any holds:
      • network.whois(.href_url.domain).days_old < 30
      • all of:
        • .href_url.domain.root_domain in $free_subdomain_hosts
        • .href_url.domain.subdomain is set
        • .href_url.domain.subdomain is not 'www'
      • .href_url.domain.root_domain in $url_shorteners
      • .href_url.domain.root_domain in $social_landing_hosts
      • .href_url.domain.domain in $url_shorteners
      • .href_url.domain.domain in $social_landing_hosts
      • .href_url.domain.tld in $suspicious_tlds
      • any of ml.link_analysis(.href_url).final_dom.links where any holds:
        • .href_url.domain.root_domain in $free_file_hosts
        • .href_url.domain.domain in $free_file_hosts
        • all of:
          • .href_url.domain.root_domain in $free_subdomain_hosts
          • .href_url.domain.subdomain is set
          • .href_url.domain.subdomain is not 'www'
        • .href_url.domain.root_domain in $url_shorteners
        • .href_url.domain.root_domain in $social_landing_hosts
        • .href_url.domain.domain in $url_shorteners
        • .href_url.domain.domain in $social_landing_hosts
        • .href_url.domain.tld in $suspicious_tlds
  5. not:
    • all of:
      • length(headers.reply_to) is 1
      • all of headers.reply_to where:
        • .email.domain.domain in $org_domains

Inspects: body.links, body.links[].display_text, body.links[].href_url.domain.domain, headers.reply_to, headers.reply_to[].email.domain.domain, sender.email.domain.domain, type.inbound. Sensors: ml.link_analysis, ml.nlu_classifier, network.whois, strings.istarts_with. Reference lists: $free_file_hosts, $free_subdomain_hosts, $org_domains, $social_landing_hosts, $suspicious_tlds, $url_shorteners.

Indicators matched (7)

FieldMatchValue
sender.email.domain.domainequalsgoogle.com
body.links[].href_url.domain.domainequalsdocs.google.com
ml.nlu_classifier(body.links[].display_text).entities[].nameequalsrequest
ml.nlu_classifier(body.links[].display_text).intents[].nameequalscred_theft
strings.istarts_withprefixPublished using Google Docs
ml.nlu_classifier(ml.link_analysis(filter(body.links)[], mode='aggressive').final_dom.links[].display_text).entities[].nameequalsrequest
ml.nlu_classifier(ml.link_analysis(filter(body.links)[], mode='aggressive').final_dom.links[].display_text).intents[].nameequalscred_theft