Detection rules › Sublime MQL
Link: Recipient domain in URL path
This rule detects URL paths which contain the recipient SLD multiple times. This has been observed in multiple credential phishing campaigns with MFA enrollment themed lures.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Lookalike domain |
Event coverage
Rule body MQL
type.inbound
//
and not profile.by_sender().solicited
// not high trust sender domains
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and
// any of the body links, contain the recipient domain repeating multiple times in a link path
any(
// make a list of distinct email slds
distinct(map(recipients.to, .email.domain.sld)),
// take the list of slds and cat it into a string of /sld/sld/ and search for it in links
any(body.links,
strings.icontains(.href_url.path, strings.concat("/", .., "/", .., "/"))
)
)
Detection logic
Scope: inbound message.
This rule detects URL paths which contain the recipient SLD multiple times. This has been observed in multiple credential phishing campaigns with MFA enrollment themed lures.
- inbound message
not:
- profile.by_sender().solicited
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
any of
distinct(...)where:any of
body.linkswhere:- strings.icontains(.href_url.path)
Inspects: body.links, body.links[].href_url.path, headers.auth_summary.dmarc.pass, recipients.to, recipients.to[].email.domain.sld, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender, strings.concat, strings.icontains. Reference lists: $high_trust_sender_root_domains.