Detection rules › Sublime MQL
Link: SharePoint files shared from GoDaddy federated tenants
This matches on inbound Shared File notiifcation emails from Microsoft, where any link to SharePoint contains a default GoDaddy Federated Tenant Name. These have been observed being frequently abused to send credential phishing campaigns.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| headers (collection) |
| subject |
| type |
Rule body MQL
type.inbound
// Matches the message id observed. DKIM/SPF domains can be custom and therefore are unpredictable.
and strings.starts_with(headers.message_id, '<Share-')
and strings.ends_with(headers.message_id, '@odspnotify>')
// subject matches the default "shared <filename> with you" format
and strings.ends_with(subject.subject, ' with you')
// any of the links are the default netorgft name from GoDaddy
and any(body.links,
// Default GoDaddy tenant names
strings.starts_with(.href_url.domain.subdomain, 'netorg')
and .href_url.domain.root_domain == "sharepoint.com"
)
// and sender has never had email sent to them
and not profile.by_sender().solicited
// and there haven't been any FPs reported for the sender
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
This matches on inbound Shared File notiifcation emails from Microsoft, where any link to SharePoint contains a default GoDaddy Federated Tenant Name. These have been observed being frequently abused to send credential phishing campaigns.
- inbound message
- headers.message_id starts with '<Share-'
- headers.message_id ends with '@odspnotify>'
- subject.subject ends with ' with you'
any of
body.linkswhere all hold:- .href_url.domain.subdomain starts with 'netorg'
- .href_url.domain.root_domain is 'sharepoint.com'
not:
- profile.by_sender().solicited
not:
- profile.by_sender().any_messages_benign
Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.subdomain, headers.message_id, subject.subject, type.inbound. Sensors: profile.by_sender, strings.ends_with, strings.starts_with.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
strings.starts_with | prefix | <Share- |
strings.ends_with | suffix | @odspnotify> |
strings.ends_with | suffix | with you |
strings.starts_with | prefix | netorg |
body.links[].href_url.domain.root_domain | equals | sharepoint.com |