Detection rules › Sublime MQL
Link: Shortened URL with fragment matching subject
Detects messages containing shortened links where the URL fragment appears in the email subject line, indicating potential targeted link tracking or social engineering tactics.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, BEC/Fraud |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| subject |
| type |
Rule body MQL
type.inbound
and any(body.current_thread.links,
.href_url.domain.root_domain in $url_shorteners
and .href_url.fragment is not null
and length(.href_url.fragment) > 5
and strings.contains(subject.subject, .href_url.fragment)
)
Detection logic
Scope: inbound message.
Detects messages containing shortened links where the URL fragment appears in the email subject line, indicating potential targeted link tracking or social engineering tactics.
- inbound message
any of
body.current_thread.linkswhere all hold:- .href_url.domain.root_domain in $url_shorteners
- .href_url.fragment is set
- length(.href_url.fragment) > 5
- strings.contains(subject.subject)
Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.links[].href_url.fragment, subject.subject, type.inbound. Sensors: strings.contains. Reference lists: $url_shorteners.