Detection rules › Sublime MQL
Link: Credential phishing link with undisclosed recipients
This rule detects messages with "Undisclosed Recipients" that contain a link to a credential phishing page.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion |
Event coverage
Rule body MQL
type.inbound
and (
// No Recipients
length(recipients.to) == 0
or all(recipients.to, .display_name == "Undisclosed recipients")
)
and length(recipients.cc) == 0
and length(recipients.bcc) == 0
and any(body.links,
ml.link_analysis(.).credphish.disposition == "phishing"
and ml.link_analysis(.).credphish.confidence in ("medium", "high")
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender().solicited
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
This rule detects messages with "Undisclosed Recipients" that contain a link to a credential phishing page.
- inbound message
any of:
- length(recipients.to) is 0
all of
recipients.towhere:- .display_name is 'Undisclosed recipients'
- length(recipients.cc) is 0
- length(recipients.bcc) is 0
any of
body.linkswhere all hold:- ml.link_analysis(.).credphish.disposition is 'phishing'
- ml.link_analysis(.).credphish.confidence in ('medium', 'high')
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
not:
- profile.by_sender().solicited
not:
- profile.by_sender().any_messages_benign
Inspects: body.links, headers.auth_summary.dmarc.pass, recipients.bcc, recipients.cc, recipients.to, recipients.to[].display_name, sender.email.domain.root_domain, type.inbound. Sensors: ml.link_analysis, profile.by_sender. Reference lists: $high_trust_sender_root_domains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
recipients.to[].display_name | equals | Undisclosed recipients |