Detection rules › Sublime MQL
Link: Scribd fullscreen link from suspicious sender
Detects messages containing Scribd links with the fullscreen parameter from senders with no prior benign communication or recent history.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Free file host, Social engineering, Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and length(body.links) < 10
and any(body.links,
(
.href_url.domain.root_domain == "scribd.com"
or strings.icontains(.href_url.query_params, 'scribd.com')
or strings.icontains(.href_url.query_params, 'scribd%2ecom')
or strings.icontains(.href_url.query_params, 'scribd%252ecom')
)
and strings.icontains(.href_url.fragment, 'fullscreen')
)
and not profile.by_sender_email().any_messages_benign
Detection logic
Scope: inbound message.
Detects messages containing Scribd links with the fullscreen parameter from senders with no prior benign communication or recent history.
- inbound message
- length(body.links) < 10
any of
body.linkswhere all hold:any of:
- .href_url.domain.root_domain is 'scribd.com'
- .href_url.query_params contains 'scribd.com'
- .href_url.query_params contains 'scribd%2ecom'
- .href_url.query_params contains 'scribd%252ecom'
- .href_url.fragment contains 'fullscreen'
not:
- profile.by_sender_email().any_messages_benign
Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.fragment, body.links[].href_url.query_params, type.inbound. Sensors: profile.by_sender_email, strings.icontains.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | scribd.com |
strings.icontains | substring | scribd.com |
strings.icontains | substring | scribd%2ecom |
strings.icontains | substring | scribd%252ecom |
strings.icontains | substring | fullscreen |