Detection rules › Sublime MQL
Link: Document sharing invitation template
Detects inbound messages containing text indicating a document sharing invitation with the specific phrase 'has invited you to VIEW the following document:', commonly used in malicious document sharing schemes.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Social engineering, Free file host |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| type |
Rule body MQL
type.inbound
and strings.contains(body.current_thread.text,
'has invited you to VIEW the following document:'
)
and length(body.current_thread.links) > 0
Detection logic
Scope: inbound message.
Detects inbound messages containing text indicating a document sharing invitation with the specific phrase 'has invited you to VIEW the following document:', commonly used in malicious document sharing schemes.
- inbound message
- body.current_thread.text contains 'has invited you to VIEW the following document:'
- length(body.current_thread.links) > 0
Inspects: body.current_thread.links, body.current_thread.text, type.inbound. Sensors: strings.contains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
strings.contains | substring | has invited you to VIEW the following document: |