Detection rules › Sublime MQL
Link: Recipient email address in 'eta' parameter
Detects links containing the recipient's email address in the 'eta' query parameter, a technique commonly used to personalize malicious links and track targets.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Social engineering, Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| recipients |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and length(recipients.to) == 1
and any(body.links,
// eta is the only key
length(keys(.href_url.query_params_decoded)) == 1
and (
// the recpieints email domain is in the value
// we've seen cases where `.` in the local part are not in the value, thus we rely on domain only
strings.icontains(.href_url.query_params_decoded["eta"][0],
recipients.to[0].email.domain.domain
)
// support base64 form as well
or strings.icontains(strings.decode_base64(.href_url.query_params_decoded["eta"][0]
),
recipients.to[0].email.domain.domain
)
)
)
Detection logic
Scope: inbound message.
Detects links containing the recipient's email address in the 'eta' query parameter, a technique commonly used to personalize malicious links and track targets.
- inbound message
- length(recipients.to) is 1
any of
body.linkswhere all hold:- length(keys(.href_url.query_params_decoded)) is 1
any of:
- strings.icontains(.href_url.query_params_decoded['eta'][0])
- strings.icontains(strings.decode_base64(.href_url.query_params_decoded['eta'][0]))
Inspects: body.links, body.links[].href_url.query_params_decoded, body.links[].href_url.query_params_decoded['eta'][0], recipients.to, recipients.to[0].email.domain.domain, type.inbound. Sensors: strings.decode_base64, strings.icontains.