Detection rules › Sublime MQL

Link: WordPress admin targeting with recipient identifier in URL fragment

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing links to WordPress administrative paths (wp-admin, wp-content, wp-includes, etc.) where the URL fragment contains base64-encoded data that includes the recipient's email address, indicating potential targeted compromise attempts.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Social engineering

Event coverage

Rule body MQL

type.inbound
and any(body.links,
        regex.icontains(.href_url.path,
                        '^\/(?:wp-(?:admin|includes|content|login|json|signup|activate|cron|mail)|xmlrpc\.php)'
        )
        // base64 encoded
        and (
          any(strings.scan_base64(.href_url.fragment),
              strings.icontains(., recipients.to[0].email.email)
          )
          // not base64
          or strings.icontains(.href_url.fragment, recipients.to[0].email.email)
        )
)

Detection logic

Scope: inbound message.

Detects messages containing links to WordPress administrative paths (wp-admin, wp-content, wp-includes, etc.) where the URL fragment contains base64-encoded data that includes the recipient's email address, indicating potential targeted compromise attempts.

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.path matches '^\\/(?:wp-(?:admin|includes|content|login|json|signup|activate|cron|mail)|xmlrpc\\.php)'
    • any of:
      • any of strings.scan_base64(.href_url.fragment) where:
        • strings.icontains(.)
      • strings.icontains(.href_url.fragment)

Inspects: body.links, body.links[].href_url.fragment, body.links[].href_url.path, recipients.to[0].email.email, type.inbound. Sensors: regex.icontains, strings.icontains, strings.scan_base64.

Indicators matched (1)

FieldMatchValue
regex.icontainsregex^\/(?:wp-(?:admin|includes|content|login|json|signup|activate|cron|mail)|xmlrpc\.php)