detection.wiki

Detection rules › Sublime MQL

Link: Webflow link from unsolicited sender

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

This detection rule matches on messaging containing at least one link to webflow.io from an unsolicited sender. Webflow.io provides a free plan enabling users to create custom websites and file hosting. This services has been abused by threat actors to host landing pages directing victims to a next stage of credential phishing.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCallback Phishing
Tactics and techniquesFree file host, Free subdomain host

Event coverage

Message attribute
body
body.links (collection)
headers.auth_summary
sender.email
type

Rule body MQL

type.inbound
and any(body.links,
        // webflow link
        .href_url.domain.root_domain == 'webflow.io'
        and .href_url.domain.subdomain != ""
        and .href_url.domain.subdomain != "www"
        and .href_url.path == "/"
)
// not solicited or from malicious/spam user with no FPs
and (
  not profile.by_sender_email().solicited
  or (
    profile.by_sender_email().any_messages_malicious_or_spam
    and not profile.by_sender_email().any_messages_benign
  )
)

// not from high trust sender root domains
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

This detection rule matches on messaging containing at least one link to webflow.io from an unsolicited sender. Webflow.io provides a free plan enabling users to create custom websites and file hosting. This services has been abused by threat actors to host landing pages directing victims to a next stage of credential phishing.

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.domain.root_domain is 'webflow.io'
    • .href_url.domain.subdomain is not ''
    • .href_url.domain.subdomain is not 'www'
    • .href_url.path is '/'
  3. any of:
    • not:
      • profile.by_sender_email().solicited
    • all of:
      • profile.by_sender_email().any_messages_malicious_or_spam
      • not:
        • profile.by_sender_email().any_messages_benign
  4. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.subdomain, body.links[].href_url.path, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender_email. Reference lists: $high_trust_sender_root_domains.

Indicators matched (2)

FieldMatchValue
body.links[].href_url.domain.root_domainequalswebflow.io
body.links[].href_url.pathequals/