Detection rules › Sublime MQL

Link: Recipient domain in URL path

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule detects URL paths which contain the recipient SLD multiple times. This has been observed in multiple credential phishing campaigns with MFA enrollment themed lures.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesLookalike domain

Event coverage

Rule body MQL

type.inbound
// 
and not profile.by_sender().solicited
// not high trust sender domains
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and 
// any of the body links, contain the recipient domain repeating multiple times in a link path
any(
    // make a list of distinct email slds
    distinct(map(recipients.to, .email.domain.sld)),
    // take the list of slds and cat it into a string of /sld/sld/ and search for it in links
    any(body.links,
        strings.icontains(.href_url.path, strings.concat("/", .., "/", .., "/"))
    )
)

Detection logic

Scope: inbound message.

This rule detects URL paths which contain the recipient SLD multiple times. This has been observed in multiple credential phishing campaigns with MFA enrollment themed lures.

  1. inbound message
  2. not:
    • profile.by_sender().solicited
  3. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains
  4. any of distinct(...) where:
    • any of body.links where:
      • strings.icontains(.href_url.path)

Inspects: body.links, body.links[].href_url.path, headers.auth_summary.dmarc.pass, recipients.to, recipients.to[].email.domain.sld, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender, strings.concat, strings.icontains. Reference lists: $high_trust_sender_root_domains.