Detection rules › Sublime MQL
Link: Observed URL pattern with specific domain registrar
Detects messages using Element Email service infrastructure, identified by characteristic URL patterns with /f/ paths, unsubscribe links, single domain usage, and Cloudflare domain registration. This pattern indicates potential abuse of legitimate email marketing services.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
| Tactics and techniques | Free email provider |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender.email |
| type |
Rule body MQL
type.inbound
// Signs of Email Element use
// all links are the same domain
and length(distinct(body.current_thread.links, .href_url.domain.root_domain)) == 1
// all links contain the /f/
and all(body.current_thread.links,
regex.icontains(.href_url.path, '^/(?:unsubscribe/)?f/')
)
// there is an unsub link
and length(filter(body.current_thread.links,
strings.icontains(.href_url.path, '/unsubscribe/f/')
)
) == 1
// this actor uses CF for domain management
and network.whois(sender.email.domain).registrar_name == "Cloudflare, Inc."
Detection logic
Scope: inbound message.
Detects messages using Element Email service infrastructure, identified by characteristic URL patterns with /f/ paths, unsubscribe links, single domain usage, and Cloudflare domain registration. This pattern indicates potential abuse of legitimate email marketing services.
- inbound message
- length(distinct(body.current_thread.links, .href_url.domain.root_domain)) is 1
all of
body.current_thread.linkswhere:- .href_url.path matches '^/(?:unsubscribe/)?f/'
- length(filter(body.current_thread.links, strings.icontains(.href_url.path, '/unsubscribe/f/'))) is 1
- network.whois(sender.email.domain).registrar_name is 'Cloudflare, Inc.'
Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.links[].href_url.path, sender.email.domain, type.inbound. Sensors: network.whois, regex.icontains, strings.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | ^/(?:unsubscribe/)?f/ |
strings.icontains | substring | /unsubscribe/f/ |