Detection rules › Sublime MQL
Link: SharePoint filename matches org name
Detects messages claiming to share files via SharePoint or OneDrive where the shared file name pattern matches the organizational naming pattern, indicating potential abuse of legitimate file sharing services to impersonate organizations.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Employee, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
and strings.ilike(subject.subject, "*shared*", "*invit*")
and strings.ilike(body.current_thread.text,
"*shared a file with you*",
"*shared with you*",
"*invited you to access a file*"
)
and not strings.ilike(body.current_thread.text, "invited you to edit")
and (
// use the display text of the link to determine the name of the file
any(filter(body.current_thread.links,
.href_url.domain.domain not in $tenant_domains
and (
.href_url.domain.root_domain == "sharepoint.com"
or .href_url.domain.root_domain == "1drv.ms"
// handle urls with mimecast rewriting
or (
.href_url.domain.root_domain == 'mimecastprotect.com'
and strings.icontains(.href_url.query_params,
'.sharepoint.com'
)
)
)
and .display_text != "Open"
),
.display_text =~ sender.email.domain.sld
or any(regex.extract(body.current_thread.text,
"generated through (?P<org_name>[^']+)'s use"
),
// the document name is the same as the org name as determined by the footer
// this checks that the display_text starts with the org_name
strings.istarts_with(.named_groups["org_name"], ..display_text)
// this checks that the org_name is a substring of the display_text
// it is in effect the "reverse" of the above check
or (
(
strings.istarts_with(..display_text, .named_groups["org_name"])
or strings.iends_with(..display_text,
.named_groups["org_name"]
)
)
and (
length(.named_groups["org_name"]) / (
length(..display_text) * 1.0
)
) > 0.45
)
)
)
)
Detection logic
Scope: inbound message.
Detects messages claiming to share files via SharePoint or OneDrive where the shared file name pattern matches the organizational naming pattern, indicating potential abuse of legitimate file sharing services to impersonate organizations.
- inbound message
subject.subject matches any of 2 patterns
*shared**invit*
body.current_thread.text matches any of 3 patterns
*shared a file with you**shared with you**invited you to access a file*
not:
- body.current_thread.text matches 'invited you to edit'
any of
filter(body.current_thread.links)where any holds:- .display_text is sender.email.domain.sld
any of
regex.extract(body.current_thread.text)where any holds:- strings.istarts_with(.named_groups['org_name'])
all of:
any of:
- strings.istarts_with(.display_text)
- strings.iends_with(.display_text)
- length(.named_groups['org_name']) / length(.display_text) * 1.0 > 0.45
Inspects: body.current_thread.links, body.current_thread.links[].display_text, body.current_thread.links[].href_url.domain.domain, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.links[].href_url.query_params, body.current_thread.text, sender.email.domain.sld, subject.subject, type.inbound. Sensors: regex.extract, strings.icontains, strings.iends_with, strings.ilike, strings.istarts_with. Reference lists: $tenant_domains.
Indicators matched (11)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | *shared* |
strings.ilike | substring | *invit* |
strings.ilike | substring | *shared a file with you* |
strings.ilike | substring | *shared with you* |
strings.ilike | substring | *invited you to access a file* |
strings.ilike | substring | invited you to edit |
body.current_thread.links[].href_url.domain.root_domain | equals | sharepoint.com |
body.current_thread.links[].href_url.domain.root_domain | equals | 1drv.ms |
body.current_thread.links[].href_url.domain.root_domain | equals | mimecastprotect.com |
strings.icontains | substring | .sharepoint.com |
regex.extract | regex | generated through (?P<org_name>[^']+)'s use |