Detection rules › Sublime MQL
Link: QR code in EML attachment with credential phishing indicators
This rule detects QR codes in EML attachments that return a phishing disposition when analyzed, or are leveraging a known open redirect.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Open redirect, QR code |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and length(attachments) == 1
and any(attachments,
(.content_type == "message/rfc822" or .file_extension =~ "eml")
// credential theft language in the attached EML
and any(file.explode(.),
.depth > 0
and .scan.qr.type == "url"
// linkanalysis phishing disposition
and (
ml.link_analysis(.scan.qr.url).credphish.disposition == "phishing"
or (
strings.ilike(ml.link_analysis(.scan.qr.url).final_dom.display_text,
"*robot*",
"*session check*",
"*verify*",
"*human*"
)
and length(ml.link_analysis(.scan.qr.url).final_dom.display_text
) < 250
)
or any(ml.link_analysis(.scan.qr.url).unique_urls_accessed,
.domain.domain == "challenges.cloudflare.com"
and strings.icontains(.path, "turnstile")
)
or any(.scan.qr.url.rewrite.encoders,
strings.icontains(., "open_redirect")
)
)
and .scan.qr.url.domain.root_domain not in $org_domains
)
)
Detection logic
Scope: inbound message.
This rule detects QR codes in EML attachments that return a phishing disposition when analyzed, or are leveraging a known open redirect.
- inbound message
- length(attachments) is 1
any of
attachmentswhere all hold:any of:
- .content_type is 'message/rfc822'
- .file_extension is 'eml'
any of
file.explode(.)where all hold:- .depth > 0
- .scan.qr.type is 'url'
any of:
- ml.link_analysis(.scan.qr.url).credphish.disposition is 'phishing'
all of:
ml.link_analysis(.scan.qr.url).final_dom.display_text matches any of 4 patterns
*robot**session check**verify**human*
- length(ml.link_analysis(.scan.qr.url).final_dom.display_text) < 250
any of
ml.link_analysis(.scan.qr.url).unique_urls_accessedwhere all hold:- .domain.domain is 'challenges.cloudflare.com'
- .path contains 'turnstile'
any of
.scan.qr.url.rewrite.encoderswhere:- . contains 'open_redirect'
- .scan.qr.url.domain.root_domain not in $org_domains
Inspects: attachments[].content_type, attachments[].file_extension, type.inbound. Sensors: file.explode, ml.link_analysis, strings.icontains, strings.ilike. Reference lists: $org_domains.
Indicators matched (10)
| Field | Match | Value |
|---|---|---|
attachments[].content_type | equals | message/rfc822 |
attachments[].file_extension | equals | eml |
file.explode(attachments[])[].scan.qr.type | equals | url |
strings.ilike | substring | *robot* |
strings.ilike | substring | *session check* |
strings.ilike | substring | *verify* |
strings.ilike | substring | *human* |
ml.link_analysis(file.explode(attachments[])[].scan.qr.url).unique_urls_accessed[].domain.domain | equals | challenges.cloudflare.com |
strings.icontains | substring | turnstile |
strings.icontains | substring | open_redirect |