Detection rules › Sublime MQL
Link: Direct link to riddle.com hosted showcase
Message contains a single link to a Riddle.com hosted showcase which has been observed abused for credential phishing landing
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Free file host |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and length(body.links) < 20
and any(body.links, .href_url.domain.root_domain == "riddle.com")
and length(filter(body.links,
.href_url.domain.root_domain == "riddle.com"
and strings.istarts_with(.href_url.path, '/view/')
)
) == 1
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender_email().any_messages_benign
Detection logic
Scope: inbound message.
Message contains a single link to a Riddle.com hosted showcase which has been observed abused for credential phishing landing
- inbound message
- length(body.links) < 20
any of
body.linkswhere:- .href_url.domain.root_domain is 'riddle.com'
- length(filter(body.links, .href_url.domain.root_domain == 'riddle.com' and strings.istarts_with(.href_url.path, '/view/'))) is 1
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
not:
- profile.by_sender_email().any_messages_benign
Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender_email, strings.istarts_with. Reference lists: $high_trust_sender_root_domains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | riddle.com |
strings.istarts_with | prefix | /view/ |