detection.wiki

Detection rules › Sublime MQL

Link: URL redirecting to blob URL

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing links that redirect to blob URLs, indicating potential malware delivery or credential harvesting.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesEvasion, Free file host, Open redirect

Event coverage

Message attribute
body
recipients
recipients.to (collection)
type

Rule body MQL

type.inbound
and 0 < length(body.links) < 10
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(body.links,
        // the url redirects to a blob url
        ml.link_analysis(.).effective_url.scheme =~ 'blob'
)

Detection logic

Scope: inbound message.

Detects messages containing links that redirect to blob URLs, indicating potential malware delivery or credential harvesting.

  1. inbound message
  2. all of:
    • length(body.links) > 0
    • length(body.links) < 10
  3. length(recipients.to) is 1
  4. recipients.to[0].email.domain.valid
  5. any of body.links where:
    • ml.link_analysis(.).effective_url.scheme is 'blob'

Inspects: body.links, recipients.to, recipients.to[0].email.domain.valid, type.inbound. Sensors: ml.link_analysis.