Detection rules › Sublime MQL
Link: URL path containing /moni/index
Detects inbound messages containing links to '/moni/index.' paths, either directly in the URL path or within query parameters. This pattern has been observed in the wild leading to credential phishing
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Open redirect, Evasion |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| type |
Rule body MQL
type.inbound
and any(body.current_thread.links,
regex.icontains(.href_url.path, '\/moni\/index\.')
or any(values(.href_url.query_params_decoded),
any(., regex.icontains(., '\/moni\/index\.'))
)
or .href_url.path == "/moni"
)
Detection logic
Scope: inbound message.
Detects inbound messages containing links to '/moni/index.' paths, either directly in the URL path or within query parameters. This pattern has been observed in the wild leading to credential phishing
- inbound message
any of
body.current_thread.linkswhere any holds:- .href_url.path matches '\\/moni\\/index\\.'
any of
values(.href_url.query_params_decoded)where:any of
.where:- . matches '\\/moni\\/index\\.'
- .href_url.path is '/moni'
Inspects: body.current_thread.links, body.current_thread.links[].href_url.path, body.current_thread.links[].href_url.query_params_decoded, type.inbound. Sensors: regex.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | \/moni\/index\. |
body.current_thread.links[].href_url.path | equals | /moni |