Detection rules › Sublime MQL

Link: Suspicious URL path with binary character sequence

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages containing links with URLs that follow a specific suspicious pattern: starting with a forward slash, followed by a digit, uppercase letter, alphanumeric characters, a hyphen, more alphanumeric characters, and ending with exactly five binary digits (0s and 1s).

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion

Event coverage

Rule body MQL

type.inbound
and any(body.links,
        regex.contains(.href_url.path,
                       '^\/[0-9][A-Z][a-z0-9]+\-[a-z0-9]+[01]{5}$'
        )
)

Detection logic

Scope: inbound message.

Detects inbound messages containing links with URLs that follow a specific suspicious pattern: starting with a forward slash, followed by a digit, uppercase letter, alphanumeric characters, a hyphen, more alphanumeric characters, and ending with exactly five binary digits (0s and 1s).

  1. inbound message
  2. any of body.links where:
    • .href_url.path matches '^\\/[0-9][A-Z][a-z0-9]+\\-[a-z0-9]+[01]{5}$'

Inspects: body.links, body.links[].href_url.path, type.inbound. Sensors: regex.contains.

Indicators matched (1)

FieldMatchValue
regex.containsregex^\/[0-9][A-Z][a-z0-9]+\-[a-z0-9]+[01]{5}$