Detection rules › Sublime MQL
Link: Unsolicited email contains link to page containing Tycoon URI structure
Detects links containing Tycoon phishing kit URI patterns with specific alphanumeric sequences separated by exclamation marks or at symbols from unsolicited senders.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and 0 < length(body.links) < 15
and any(body.links,
any(html.xpath(ml.link_analysis(.).final_dom, '//script//text()').nodes,
// full tycoon uri struct
any(.links,
regex.icontains(.href_url.path,
'^\/[a-z0-9]{0,30}[!@][a-z0-9]{0,30}\/'
)
and not regex.icontains(.href_url.path, '\/[!@][a-z]{2,30}\/')
and not strings.istarts_with(.href_url.domain.domain, 'www.')
and not regex.icontains(.href_url.domain.root_domain,
'(?:fpjs\.io|(?:medium|unpkg|alicdn)\.com|turtl\.co)'
)
)
)
// tycoon structured path and cloudflare captcha domain
or (
regex.icontains(.display_text,
'\/[a-zA-Z0-9]{0,30}[!@][a-zA-Z0-9]{0,30}\/'
)
and strings.icontains(.display_text, 'challenges.cloudflare.com')
)
)
Detection logic
Scope: inbound message.
Detects links containing Tycoon phishing kit URI patterns with specific alphanumeric sequences separated by exclamation marks or at symbols from unsolicited senders.
- inbound message
all of:
- length(body.links) > 0
- length(body.links) < 15
any of
body.linkswhere any holds:any of
html.xpath(ml.link_analysis(.).final_dom, '//script//text()').nodeswhere:any of
.linkswhere all hold:- .href_url.path matches '^\\/[a-z0-9]{0,30}[!@][a-z0-9]{0,30}\\/'
not:
- .href_url.path matches '\\/[!@][a-z]{2,30}\\/'
not:
- .href_url.domain.domain starts with 'www.'
not:
- .href_url.domain.root_domain matches '(?:fpjs\\.io|(?:medium|unpkg|alicdn)\\.com|turtl\\.co)'
all of:
- .display_text matches '\\/[a-zA-Z0-9]{0,30}[!@][a-zA-Z0-9]{0,30}\\/'
- .display_text contains 'challenges.cloudflare.com'
Inspects: body.links, body.links[].display_text, type.inbound. Sensors: html.xpath, ml.link_analysis, regex.icontains, strings.icontains, strings.istarts_with.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | ^\/[a-z0-9]{0,30}[!@][a-z0-9]{0,30}\/ |
regex.icontains | regex | \/[!@][a-z]{2,30}\/ |
strings.istarts_with | prefix | www. |
regex.icontains | regex | (?:fpjs\.io|(?:medium|unpkg|alicdn)\.com|turtl\.co) |
regex.icontains | regex | \/[a-zA-Z0-9]{0,30}[!@][a-zA-Z0-9]{0,30}\/ |
strings.icontains | substring | challenges.cloudflare.com |