Detection rules › Sublime MQL

Link: Microsoft protected message with matching sender and recipient addresses

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects when a user receives a protected message (RPMSG) with the to and from headers matching.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Social engineering

Event coverage

Rule body MQL

type.inbound
// contains the rpmsg
and any(attachments,
        .file_extension == "rpmsg"
        or .content_type == "application/x-microsoft-rpmsg-message"
)
// contains the proper link
and any(body.links,
        .href_url.domain.root_domain == "office365.com"
        and (
          strings.icontains(.href_url.query_params, "InternetMessageID=")
          or strings.icontains(.href_url.path, '/Encryption/retrieve.ashx')
        )
)
// the To and From headers are the same
and length(recipients.to) == 1
and all(recipients.to, .email.email == sender.email.email)

Detection logic

Scope: inbound message.

Detects when a user receives a protected message (RPMSG) with the to and from headers matching.

  1. inbound message
  2. any of attachments where any holds:
    • .file_extension is 'rpmsg'
    • .content_type is 'application/x-microsoft-rpmsg-message'
  3. any of body.links where all hold:
    • .href_url.domain.root_domain is 'office365.com'
    • any of:
      • .href_url.query_params contains 'InternetMessageID='
      • .href_url.path contains '/Encryption/retrieve.ashx'
  4. length(recipients.to) is 1
  5. all of recipients.to where:
    • .email.email is sender.email.email

Inspects: attachments[].content_type, attachments[].file_extension, body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, body.links[].href_url.query_params, recipients.to, recipients.to[].email.email, sender.email.email, type.inbound. Sensors: strings.icontains.

Indicators matched (5)

FieldMatchValue
attachments[].file_extensionequalsrpmsg
attachments[].content_typeequalsapplication/x-microsoft-rpmsg-message
body.links[].href_url.domain.root_domainequalsoffice365.com
strings.icontainssubstringInternetMessageID=
strings.icontainssubstring/Encryption/retrieve.ashx