Detection rules › Sublime MQL

Link: Unsolicited email contains link to page containing Tycoon URI structure

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects links containing Tycoon phishing kit URI patterns with specific alphanumeric sequences separated by exclamation marks or at symbols from unsolicited senders.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Social engineering

Event coverage

Rule body MQL

type.inbound
and 0 < length(body.links) < 15
and any(body.links,
        any(html.xpath(ml.link_analysis(.).final_dom, '//script//text()').nodes,
            // full tycoon uri struct
            any(.links,
                regex.icontains(.href_url.path,
                                '^\/[a-z0-9]{0,30}[!@][a-z0-9]{0,30}\/'
                )
                and not regex.icontains(.href_url.path, '\/[!@][a-z]{2,30}\/')
                and not strings.istarts_with(.href_url.domain.domain, 'www.')
                and not regex.icontains(.href_url.domain.root_domain,
                                        '(?:fpjs\.io|(?:medium|unpkg|alicdn)\.com|turtl\.co)'
                )
            )
        )
        // tycoon structured path and cloudflare captcha domain
        or (
          regex.icontains(.display_text,
                          '\/[a-zA-Z0-9]{0,30}[!@][a-zA-Z0-9]{0,30}\/'
          )
          and strings.icontains(.display_text, 'challenges.cloudflare.com')
        )
)

Detection logic

Scope: inbound message.

Detects links containing Tycoon phishing kit URI patterns with specific alphanumeric sequences separated by exclamation marks or at symbols from unsolicited senders.

  1. inbound message
  2. all of:
    • length(body.links) > 0
    • length(body.links) < 15
  3. any of body.links where any holds:
    • any of html.xpath(ml.link_analysis(.).final_dom, '//script//text()').nodes where:
      • any of .links where all hold:
        • .href_url.path matches '^\\/[a-z0-9]{0,30}[!@][a-z0-9]{0,30}\\/'
        • not:
          • .href_url.path matches '\\/[!@][a-z]{2,30}\\/'
        • not:
          • .href_url.domain.domain starts with 'www.'
        • not:
          • .href_url.domain.root_domain matches '(?:fpjs\\.io|(?:medium|unpkg|alicdn)\\.com|turtl\\.co)'
    • all of:
      • .display_text matches '\\/[a-zA-Z0-9]{0,30}[!@][a-zA-Z0-9]{0,30}\\/'
      • .display_text contains 'challenges.cloudflare.com'

Inspects: body.links, body.links[].display_text, type.inbound. Sensors: html.xpath, ml.link_analysis, regex.icontains, strings.icontains, strings.istarts_with.

Indicators matched (6)

FieldMatchValue
regex.icontainsregex^\/[a-z0-9]{0,30}[!@][a-z0-9]{0,30}\/
regex.icontainsregex\/[!@][a-z]{2,30}\/
strings.istarts_withprefixwww.
regex.icontainsregex(?:fpjs\.io|(?:medium|unpkg|alicdn)\.com|turtl\.co)
regex.icontainsregex\/[a-zA-Z0-9]{0,30}[!@][a-zA-Z0-9]{0,30}\/
strings.icontainssubstringchallenges.cloudflare.com