Detection rules › Sublime MQL
Link: Squarespace infrastructure abuse
Detects inbound messages containing exactly one Squarespace tracking link but lacking authentic Squarespace email headers and sender patterns.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Spam |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
Rule body MQL
type.inbound
and any(body.links, .href_url.domain.domain == "engage.squarespace-mail.com")
and length(body.links) < 10
// there is one unique Squarespace Link in the message
and length(distinct(filter(body.links,
.href_url.domain.domain == "engage.squarespace-mail.com"
),
.href_url.url
)
) == 1
and not headers.return_path.domain.root_domain == "squarespace-mail.com"
and not any(headers.domains, .root_domain == "squarespace-mail.com")
and profile.by_sender_email().prevalence != "common"
Detection logic
Scope: inbound message.
Detects inbound messages containing exactly one Squarespace tracking link but lacking authentic Squarespace email headers and sender patterns.
- inbound message
any of
body.linkswhere:- .href_url.domain.domain is 'engage.squarespace-mail.com'
- length(body.links) < 10
- length(distinct(filter(body.links, .href_url.domain.domain == 'engage.squarespace-mail.com'), .href_url.url)) is 1
not:
- headers.return_path.domain.root_domain is 'squarespace-mail.com'
not:
any of
headers.domainswhere:- .root_domain is 'squarespace-mail.com'
- profile.by_sender_email().prevalence is not 'common'
Inspects: body.links, body.links[].href_url.domain.domain, headers.domains, headers.domains[].root_domain, headers.return_path.domain.root_domain, type.inbound. Sensors: profile.by_sender_email.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.domain | equals | engage.squarespace-mail.com |
headers.return_path.domain.root_domain | equals | squarespace-mail.com |
headers.domains[].root_domain | equals | squarespace-mail.com |