Detection rules › Sublime MQL
Link: Apple TestFlight from suspicious sender
Detects messages containing Apple TestFlight links from free email providers or suspicious senders with no prior benign communication history.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Free email provider, Evasion |
Event coverage
Rule body MQL
type.inbound
and any(body.links,
.href_url.domain.domain in ('testflight.apple.com')
or (
.href_url.domain.root_domain == "mimecastprotect.com"
and any(.href_url.query_params_decoded['domain'],
. in ("testflight.apple.com")
)
)
)
and not (
(subject.is_forward or subject.is_reply)
and (length(headers.references) != 0 or headers.in_reply_to is not null)
and length(body.previous_threads) > 0
)
and (
sender.email.domain.domain in $free_email_providers
or beta.profile.by_reply_to().solicited == false
or (
beta.profile.by_reply_to().any_messages_malicious_or_spam
and not beta.profile.by_reply_to().any_messages_benign
)
)
Detection logic
Scope: inbound message.
Detects messages containing Apple TestFlight links from free email providers or suspicious senders with no prior benign communication history.
- inbound message
any of
body.linkswhere any holds:- .href_url.domain.domain in ('testflight.apple.com')
all of:
- .href_url.domain.root_domain is 'mimecastprotect.com'
any of
.href_url.query_params_decoded['domain']where:- . in ('testflight.apple.com')
not:
all of:
any of:
- subject.is_forward
- subject.is_reply
any of:
- length(headers.references) is not 0
- headers.in_reply_to is set
- length(body.previous_threads) > 0
any of:
- sender.email.domain.domain in $free_email_providers
- beta.profile.by_reply_to().solicited is False
all of:
- beta.profile.by_reply_to().any_messages_malicious_or_spam
not:
- beta.profile.by_reply_to().any_messages_benign
Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.query_params_decoded['domain'], body.previous_threads, headers.in_reply_to, headers.references, sender.email.domain.domain, subject.is_forward, subject.is_reply, type.inbound. Sensors: beta.profile.by_reply_to. Reference lists: $free_email_providers.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.domain | member | testflight.apple.com |
body.links[].href_url.domain.root_domain | equals | mimecastprotect.com |
body.links[].href_url.query_params_decoded['domain'][] | member | testflight.apple.com |