Detection rules › Sublime MQL
Link: Suspicious go.php redirect with document lure
Detects links containing a PHP redirect endpoint with authentication parameters, commonly used in malicious redirects and unauthorized access attempts.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| type |
Rule body MQL
type.inbound
and any(body.current_thread.links,
strings.ends_with(.href_url.path, "go.php")
and strings.starts_with(.href_url.query_params, "auth=")
and strings.count(.href_url.path, "/") == 2
)
Detection logic
Scope: inbound message.
Detects links containing a PHP redirect endpoint with authentication parameters, commonly used in malicious redirects and unauthorized access attempts.
- inbound message
any of
body.current_thread.linkswhere all hold:- .href_url.path ends with 'go.php'
- .href_url.query_params starts with 'auth='
- strings.count(.href_url.path, '/') is 2
Inspects: body.current_thread.links, body.current_thread.links[].href_url.path, body.current_thread.links[].href_url.query_params, type.inbound. Sensors: strings.count, strings.ends_with, strings.starts_with.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
strings.ends_with | suffix | go.php |
strings.starts_with | prefix | auth= |