Detection rules › Sublime MQL
Link: ScreenConnect installer with suspicious relay domain
Detects when a link leads to a ConnectWise ScreenConnect installer and references a relay domain that doesn't match sender or organizational domains.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion, Out of band pivot, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
and any(body.links,
strings.ends_with(.href_url.url, ".exe")
and any(ml.link_analysis(., mode="aggressive").files_downloaded,
any(file.explode(.),
any(.scan.strings.strings,
strings.icontains(., "ScreenConnect")
)
and any(filter(.scan.strings.strings,
strings.icontains(.,
"h="
) // relay domain
and strings.icontains(.,
"k="
) // encoded encryption key
),
any(regex.extract(., 'h=(?P<url>[^&]+)'),
strings.parse_url(strings.concat("https://",
.named_groups["url"]
)
).domain.root_domain not in $org_domains
and strings.parse_url(strings.concat("https://",
.named_groups["url"]
)
).domain.root_domain != sender.email.domain.root_domain
)
)
)
)
)
and not profile.by_sender_email().any_messages_benign
Detection logic
Scope: inbound message.
Detects when a link leads to a ConnectWise ScreenConnect installer and references a relay domain that doesn't match sender or organizational domains.
- inbound message
any of
body.linkswhere all hold:- .href_url.url ends with '.exe'
any of
ml.link_analysis(., mode='aggressive').files_downloadedwhere:any of
file.explode(.)where all hold:any of
.scan.strings.stringswhere:- . contains 'ScreenConnect'
any of
filter(.scan.strings.strings)where:any of
regex.extract(.)where all hold:- strings.parse_url(strings.concat('https://', .named_groups['url'])).domain.root_domain not in $org_domains
- strings.parse_url(strings.concat('https://', .named_groups['url'])).domain.root_domain is not sender.email.domain.root_domain
not:
- profile.by_sender_email().any_messages_benign
Inspects: body.links, body.links[].href_url.url, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, ml.link_analysis, profile.by_sender_email, regex.extract, strings.concat, strings.ends_with, strings.icontains, strings.parse_url. Reference lists: $org_domains.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
strings.ends_with | suffix | .exe |
strings.icontains | substring | ScreenConnect |
strings.icontains | substring | h= |
strings.icontains | substring | k= |
regex.extract | regex | h=(?P<url>[^&]+) |