Detection rules › Sublime MQL
Mass campaign: Cross Site Scripting (XSS) attempt
Message subject or body contains Cross Site Scripting (XSS) indicators, and was sent to multiple unknown senders. Known spam technique.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware, Spam |
| Tactics and techniques | Exploit, Free email provider, Scripting, Social engineering |
Event coverage
Rule body MQL
type.inbound
and (
length(recipients.to) > 10
and length(filter(recipients.to,
.email.domain.domain not in $org_domains
and .email.email not in $recipient_emails
and (
.email.domain.valid
or strings.icontains(.display_name, "undisclosed")
)
)
) >= 10
)
and (
strings.ilike(subject.subject,
'*<*script*>*',
'*xss.report*',
'*eval(atob*',
'*<*onload*>*',
'*<*onerror*>*'
)
or strings.ilike(body.current_thread.text,
'*<*script*>*',
'*xss.report*',
'*eval(atob*',
'*<*onload*>*',
'*<*onerror*>*'
)
)
and (
length(body.links) == 0
or (
length(body.links) == 1
and all(body.links, .href_url.domain.domain == "this.id")
)
)
and profile.by_sender().prevalence != "common"
and not profile.by_sender().solicited
and not profile.by_sender().any_messages_benign
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and (
any(distinct(headers.hops, .authentication_results.dmarc is not null),
strings.ilike(.authentication_results.dmarc, "*fail")
)
)
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Message subject or body contains Cross Site Scripting (XSS) indicators, and was sent to multiple unknown senders. Known spam technique.
- inbound message
all of:
- length(recipients.to) > 10
- length(filter(recipients.to, .email.domain.domain not in $org_domains and .email.email not in $recipient_emails and .email.domain.valid or strings.icontains(.display_name, 'undisclosed'))) ≥ 10
any of:
subject.subject matches any of 5 patterns
*<*script*>**xss.report**eval(atob**<*onload*>**<*onerror*>*
body.current_thread.text matches any of 5 patterns
*<*script*>**xss.report**eval(atob**<*onload*>**<*onerror*>*
any of:
- length(body.links) is 0
all of:
- length(body.links) is 1
all of
body.linkswhere:- .href_url.domain.domain is 'this.id'
- profile.by_sender().prevalence is not 'common'
not:
- profile.by_sender().solicited
not:
- profile.by_sender().any_messages_benign
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
any of
distinct(headers.hops)where:- .authentication_results.dmarc matches '*fail'
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.domain, headers.hops, headers.hops[].authentication_results.dmarc, recipients.to, recipients.to[].display_name, recipients.to[].email.domain.domain, recipients.to[].email.domain.valid, recipients.to[].email.email, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: profile.by_sender, strings.icontains, strings.ilike. Reference lists: $high_trust_sender_root_domains, $org_domains, $recipient_emails.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | undisclosed |
strings.ilike | substring | *<*script*>* |
strings.ilike | substring | *xss.report* |
strings.ilike | substring | *eval(atob* |
strings.ilike | substring | *<*onload*>* |
strings.ilike | substring | *<*onerror*>* |
body.links[].href_url.domain.domain | equals | this.id |
strings.ilike | substring | *fail |