Detection rules › Sublime MQL

Sublime MQL rules: malformed

Rule	Severity
Malformed URL prefix	`high`

Malformed URL prefix

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Malformed URL prefix is a technique used to evade email security scanners.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing, Malware/Ransomware
Tactics and techniques	Evasion

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
body.links
body.plain

Rule body

any(body.links, strings.icontains(.href_url.url, ':/\'))
or (
  regex.icontains(body.plain.raw, 'https?:\\\\[^\\s]+')
  and (
    length(filter(body.current_thread.links,
                  strings.icontains(.href_url.rewrite.original,
                                    "safelinks.protection.outlook.com"
                  )
           )
    ) == 0
    or not all(filter(body.current_thread.links,
                      strings.icontains(.href_url.rewrite.original,
                                        "safelinks.protection.outlook.com"
                      )
               ),
               strings.icontains(body.plain.raw, .href_url.domain.root_domain)
    )
  )
)

Detection logic

Malformed URL prefix is a technique used to evade email security scanners.

any of:

any of body.links where:
- .href_url.url contains ':/\\'
all of:
- body.plain.raw matches 'https?:\\\\\\\\[^\\\\s]+'
- any of:
  - length(filter(body.current_thread.links, strings.icontains(.href_url.rewrite.original, 'safelinks.protection.outlook.com'))) is 0
  - not:
    
    all of filter(body.current_thread.links) where:
    
    strings.icontains(body.plain.raw)

Inspects: body.current_thread.links, body.current_thread.links[].href_url.rewrite.original, body.links, body.links[].href_url.url, body.plain.raw. Sensors: regex.icontains, strings.icontains.

Indicators matched (3)

Field	Match	Value
`strings.icontains`	substring	`:/\`
`regex.icontains`	regex	`https?:\\\\[^\\s]+`
`strings.icontains`	substring	`safelinks.protection.outlook.com`

Stages and Predicates

Stage 1: `mql_rule`

or
  and
    or
      not
         macro "all(filter(body.current_thread.links))"
      filter(body.current_thread.links, strings.icontains(.href_url.rewrite.original, 'safelinks.protection.outlook.com')) length_compare "0"
    body.plain.raw regex_match "https?:\\\\\\\\[^\\\\s]+"
  any(body.links)
    body.links.href_url.url contains ":/\\"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`body.plain.raw`	regex_match	`https?:\\[^\s]+`	`field:"body.plain.raw" kind:regex_match value:"https?:\\[^\s]+"`