Detection rules › Sublime MQL
Link: SVG with embedded recipient data
Detects SVG links that contain the recipient's email address either in plain text or base64 encoded format within the URL, indicating potential tracking or targeting mechanisms.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| recipients |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and any(body.links,
strings.iends_with(.href_url.path, '.svg')
and any(recipients.to,
.email.domain.valid
// contained in the url
and (
strings.icontains(..href_url.url, .email.email)
// or contains the base64 endcoded email
or any(strings.scan_base64(..href_url.url,
format="url",
ignore_padding=true
),
strings.icontains(., ..email.email)
)
)
)
)
Detection logic
Scope: inbound message.
Detects SVG links that contain the recipient's email address either in plain text or base64 encoded format within the URL, indicating potential tracking or targeting mechanisms.
- inbound message
any of
body.linkswhere all hold:- .href_url.path ends with '.svg'
any of
recipients.towhere all hold:- .email.domain.valid
any of:
- strings.icontains(.href_url.url)
any of
strings.scan_base64(.href_url.url)where:- strings.icontains(.)
Inspects: body.links, body.links[].href_url.path, body.links[].href_url.url, recipients.to, recipients.to[].email.domain.valid, recipients.to[].email.email, type.inbound. Sensors: strings.icontains, strings.iends_with, strings.scan_base64.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
strings.iends_with | suffix | .svg |