Detection rules › Sublime MQL
Link: Personal SharePoint with invalid recipients and credential theft language
Detects messages with undisclosed or invalid recipients containing a single link to a personal SharePoint domain (with '-my' pattern) and high-confidence credential theft language in short message body.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Social engineering |
Event coverage
Rule body MQL
type.inbound
// undisclosed recipients or no recipients
and (
length(recipients.to) == 0
or (
all(recipients.to, .email.domain.valid == false)
and all(recipients.cc, .email.domain.valid == false)
)
)
// no previous threads
and length(body.previous_threads) == 0
// personal SharePoint domain pattern (firstname-my.sharepoint.com or similar)
and any(body.links,
.href_url.domain.root_domain == "sharepoint.com"
and strings.icontains(.href_url.domain.subdomain, "-my")
)
// high confidence credential theft intent from ML
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "cred_theft" and .confidence in ("medium", "high")
)
// and message is relatively short and contains a single link
and (
length(body.current_thread.text) < 1500
and length(body.current_thread.links) == 1
)
Detection logic
Scope: inbound message.
Detects messages with undisclosed or invalid recipients containing a single link to a personal SharePoint domain (with '-my' pattern) and high-confidence credential theft language in short message body.
- inbound message
any of:
- length(recipients.to) is 0
all of:
all of
recipients.towhere:- .email.domain.valid is False
all of
recipients.ccwhere:- .email.domain.valid is False
- length(body.previous_threads) is 0
any of
body.linkswhere all hold:- .href_url.domain.root_domain is 'sharepoint.com'
- .href_url.domain.subdomain contains '-my'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'cred_theft'
- .confidence in ('medium', 'high')
all of:
- length(body.current_thread.text) < 1500
- length(body.current_thread.links) is 1
Inspects: body.current_thread.links, body.current_thread.text, body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.subdomain, body.previous_threads, recipients.cc, recipients.cc[].email.domain.valid, recipients.to, recipients.to[].email.domain.valid, type.inbound. Sensors: ml.nlu_classifier, strings.icontains.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | sharepoint.com |
strings.icontains | substring | -my |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | cred_theft |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | member | medium |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | member | high |