Detection rules › Sublime MQL
Link: WordPress admin targeting with recipient identifier in URL fragment
Detects messages containing links to WordPress administrative paths (wp-admin, wp-content, wp-includes, etc.) where the URL fragment contains base64-encoded data that includes the recipient's email address, indicating potential targeted compromise attempts.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and any(body.links,
regex.icontains(.href_url.path,
'^\/(?:wp-(?:admin|includes|content|login|json|signup|activate|cron|mail)|xmlrpc\.php)'
)
// base64 encoded
and (
any(strings.scan_base64(.href_url.fragment),
strings.icontains(., recipients.to[0].email.email)
)
// not base64
or strings.icontains(.href_url.fragment, recipients.to[0].email.email)
)
)
Detection logic
Scope: inbound message.
Detects messages containing links to WordPress administrative paths (wp-admin, wp-content, wp-includes, etc.) where the URL fragment contains base64-encoded data that includes the recipient's email address, indicating potential targeted compromise attempts.
- inbound message
any of
body.linkswhere all hold:- .href_url.path matches '^\\/(?:wp-(?:admin|includes|content|login|json|signup|activate|cron|mail)|xmlrpc\\.php)'
any of:
any of
strings.scan_base64(.href_url.fragment)where:- strings.icontains(.)
- strings.icontains(.href_url.fragment)
Inspects: body.links, body.links[].href_url.fragment, body.links[].href_url.path, recipients.to[0].email.email, type.inbound. Sensors: regex.icontains, strings.icontains, strings.scan_base64.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | ^\/(?:wp-(?:admin|includes|content|login|json|signup|activate|cron|mail)|xmlrpc\.php) |