detection.wiki

Detection rules › Sublime MQL

Link: Credential phishing via WordPress

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects when non-WordPress senders link to suspended or malicious WordPress blog sites, commonly used to redirect users to credential harvesting pages.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesSocial engineering, Free subdomain host

Event coverage

Message attribute
body
body.links (collection)
headers (collection)
sender.email
type

Rule body MQL

type.inbound
and sender.email.domain.root_domain != "wordpress.com"
// there are few links
and 0 < length(body.links) <= 5
// there are wordpress links
and any(body.links,
        .href_url.domain.root_domain == "wordpress.com"
        and .href_url.domain.domain != "wordpress.com"
)
// a single link to wordpress site
and length(filter(body.links,
                  .href_url.domain.root_domain == "wordpress.com"
                  and .href_url.domain.domain != "wordpress.com"
           )
) == 1

// not a reply
and length(headers.references) == 0
and headers.in_reply_to is null

// we detect the wordpress page has phishing
and any(filter(body.links, .href_url.domain.root_domain == "wordpress.com"),
        ml.link_analysis(.).credphish.disposition == "phishing"
        or strings.icontains(ml.link_analysis(.).final_dom.display_text,
                             'This blog has been archived or suspended in accordance with our Terms of Service'
        )
)

Detection logic

Scope: inbound message.

Detects when non-WordPress senders link to suspended or malicious WordPress blog sites, commonly used to redirect users to credential harvesting pages.

  1. inbound message
  2. sender.email.domain.root_domain is not 'wordpress.com'
  3. all of:
    • length(body.links) > 0
    • length(body.links) ≤ 5
  4. any of body.links where all hold:
    • .href_url.domain.root_domain is 'wordpress.com'
    • .href_url.domain.domain is not 'wordpress.com'
  5. length(filter(body.links, .href_url.domain.root_domain == 'wordpress.com' and .href_url.domain.domain != 'wordpress.com')) is 1
  6. length(headers.references) is 0
  7. headers.in_reply_to is missing
  8. any of filter(body.links) where any holds:
    • ml.link_analysis(.).credphish.disposition is 'phishing'
    • ml.link_analysis(.).final_dom.display_text contains 'This blog has been archived or suspended in accordance with our Terms of Service'

Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, headers.in_reply_to, headers.references, sender.email.domain.root_domain, type.inbound. Sensors: ml.link_analysis, strings.icontains.

Indicators matched (2)

FieldMatchValue
body.links[].href_url.domain.root_domainequalswordpress.com
strings.icontainssubstringThis blog has been archived or suspended in accordance with our Terms of Service