Detection rules › Sublime MQL
Malformed URL prefix
Malformed URL prefix is a technique used to evade email security scanners.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| body |
| body.current_thread |
| body.links (collection) |
| body.plain |
Rule body MQL
any(body.links, regex.icontains(.href_url.url, ':/\\'))
or (
regex.icontains(body.plain.raw, 'https?:\\\\[^\\s]+')
and (
length(filter(body.current_thread.links,
strings.icontains(.href_url.rewrite.original,
"safelinks.protection.outlook.com"
)
)
) == 0
or not all(filter(body.current_thread.links,
strings.icontains(.href_url.rewrite.original,
"safelinks.protection.outlook.com"
)
),
strings.icontains(body.plain.raw, .href_url.domain.root_domain)
)
)
)
Detection logic
Malformed URL prefix is a technique used to evade email security scanners.
any of:
any of
body.linkswhere:- .href_url.url matches ':/\\\\'
all of:
- body.plain.raw matches 'https?:\\\\\\\\[^\\\\s]+'
any of:
- length(filter(body.current_thread.links, strings.icontains(.href_url.rewrite.original, 'safelinks.protection.outlook.com'))) is 0
not:
all of
filter(body.current_thread.links)where:- strings.icontains(body.plain.raw)
Inspects: body.current_thread.links, body.current_thread.links[].href_url.rewrite.original, body.links, body.links[].href_url.url, body.plain.raw. Sensors: regex.icontains, strings.icontains.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | :/\\ |
regex.icontains | regex | https?:\\\\[^\\s]+ |
strings.icontains | substring | safelinks.protection.outlook.com |