Detection rules › Sublime MQL
Link: SharePoint OneNote or PDF link with self sender behavior
Detects messages where the sender and recipient are the same address, containing SharePoint links to OneNote or PDF files, with minimal attachments and non-standard message IDs indicating potential abuse of SharePoint services for malicious purposes.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Free file host, OneNote, PDF |
Event coverage
Rule body MQL
type.inbound
// self sender
and length(recipients.to) == 1
and recipients.to[0].email.email == sender.email.email
// single link to sharepoint
and length(filter(body.current_thread.links,
.href_url.domain.root_domain == 'sharepoint.com'
// it is either a OneNote or PDF file, or unknown
and regex.icontains(.href_url.path,
'\/:[obu]:\/(?:p|g\/personal)'
)
)
) == 1
// only one link to sharepoint
and length(filter(body.current_thread.links,
.href_url.domain.root_domain == 'sharepoint.com'
)
) == 1
// not sent via sharepoint
and not strings.starts_with(headers.message_id, '<Share-')
and not strings.ends_with(headers.message_id, '@odspnotify>')
// 0 or 1 attachments (this reduces FPs which had many attachments)
and length(attachments) - length(filter(attachments,
strings.contains(body.html.raw,
strings.concat('src="cid:',
.content_id
)
)
)
) <= 1
Detection logic
Scope: inbound message.
Detects messages where the sender and recipient are the same address, containing SharePoint links to OneNote or PDF files, with minimal attachments and non-standard message IDs indicating potential abuse of SharePoint services for malicious purposes.
- inbound message
- length(recipients.to) is 1
- recipients.to[0].email.email is sender.email.email
- length(filter(body.current_thread.links, .href_url.domain.root_domain == 'sharepoint.com' and regex.icontains(.href_url.path, '\\/:[obu]:\\/(?:p|g\\/personal)'))) is 1
- length(filter(body.current_thread.links, .href_url.domain.root_domain == 'sharepoint.com')) is 1
not:
- headers.message_id starts with '<Share-'
not:
- headers.message_id ends with '@odspnotify>'
- length(attachments) - length(filter(attachments, strings.contains(body.html.raw, strings.concat('src="cid:', .content_id)))) ≤ 1
Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.links[].href_url.path, headers.message_id, recipients.to, recipients.to[0].email.email, sender.email.email, type.inbound. Sensors: regex.icontains, strings.ends_with, strings.starts_with.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
body.current_thread.links[].href_url.domain.root_domain | equals | sharepoint.com |
regex.icontains | regex | \/:[obu]:\/(?:p|g\/personal) |
strings.starts_with | prefix | <Share- |
strings.ends_with | suffix | @odspnotify> |