Detection rules › Sublime MQL

Link: SharePoint files shared from GoDaddy federated tenants

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

This matches on inbound Shared File notiifcation emails from Microsoft, where any link to SharePoint contains a default GoDaddy Federated Tenant Name. These have been observed being frequently abused to send credential phishing campaigns.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion

Event coverage

Rule body MQL

type.inbound
// Matches the message id observed. DKIM/SPF domains can be custom and therefore are unpredictable.
and strings.starts_with(headers.message_id, '<Share-')
and strings.ends_with(headers.message_id, '@odspnotify>')

// subject matches the default "shared <filename> with you" format
and strings.ends_with(subject.subject, ' with you')

// any of the links are the default netorgft name from GoDaddy
and any(body.links,
        // Default GoDaddy tenant names
        strings.starts_with(.href_url.domain.subdomain, 'netorg')
        and .href_url.domain.root_domain == "sharepoint.com"
)

// and sender has never had email sent to them
and not profile.by_sender().solicited

// and there haven't been any FPs reported for the sender
and not profile.by_sender().any_messages_benign

Detection logic

Scope: inbound message.

This matches on inbound Shared File notiifcation emails from Microsoft, where any link to SharePoint contains a default GoDaddy Federated Tenant Name. These have been observed being frequently abused to send credential phishing campaigns.

  1. inbound message
  2. headers.message_id starts with '<Share-'
  3. headers.message_id ends with '@odspnotify>'
  4. subject.subject ends with ' with you'
  5. any of body.links where all hold:
    • .href_url.domain.subdomain starts with 'netorg'
    • .href_url.domain.root_domain is 'sharepoint.com'
  6. not:
    • profile.by_sender().solicited
  7. not:
    • profile.by_sender().any_messages_benign

Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.subdomain, headers.message_id, subject.subject, type.inbound. Sensors: profile.by_sender, strings.ends_with, strings.starts_with.

Indicators matched (5)

FieldMatchValue
strings.starts_withprefix<Share-
strings.ends_withsuffix@odspnotify>
strings.ends_withsuffix with you
strings.starts_withprefixnetorg
body.links[].href_url.domain.root_domainequalssharepoint.com