Detection rules › Sublime MQL

Link: Shortened URL with fragment matching subject

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing shortened links where the URL fragment appears in the email subject line, indicating potential targeted link tracking or social engineering tactics.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, BEC/Fraud
Tactics and techniquesEvasion, Social engineering

Event coverage

Rule body MQL

type.inbound
and any(body.current_thread.links,
        .href_url.domain.root_domain in $url_shorteners
        and .href_url.fragment is not null
        and length(.href_url.fragment) > 5
        and strings.contains(subject.subject, .href_url.fragment)
)

Detection logic

Scope: inbound message.

Detects messages containing shortened links where the URL fragment appears in the email subject line, indicating potential targeted link tracking or social engineering tactics.

  1. inbound message
  2. any of body.current_thread.links where all hold:
    • .href_url.domain.root_domain in $url_shorteners
    • .href_url.fragment is set
    • length(.href_url.fragment) > 5
    • strings.contains(subject.subject)

Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.links[].href_url.fragment, subject.subject, type.inbound. Sensors: strings.contains. Reference lists: $url_shorteners.