Detection rules › Sublime MQL

Sublime MQL rules: phaas

Rule	Severity
PhaaS: Impact Solutions (Impact Vector Suite)	`medium`

PhaaS: Impact Solutions (Impact Vector Suite)

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

Identifies the use of the Impact Solutions PhaaS. Impact Vector Suite is a full-spectrum payload delivery platform, engineered for stealth-optimized execution across all major deployment vectors.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	Evasion

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

attachments
body
body.links
type

Rule body

type.inbound
and (
  // attached html/svg
  any(filter(attachments, .file_type in ("html", "svg")),
      regex.count(file.parse_text(.).text,
                  'const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\s*='
      ) >= 3
      or (
        strings.icontains(file.parse_text(.).text, 'const baseDomain')
        and strings.icontains(file.parse_text(.).text, 'const port')
        and strings.icontains(file.parse_text(.).text, 'const path')
      )
      or strings.icontains(file.parse_text(.).text, 'impact?')
      or regex.contains(file.parse_text(.).text, '\d/impact')
  )

  // attached EMLs with html/svg attachments
  or any(filter(attachments,
                .content_type == "message/rfc822" or .file_extension == "eml"
         ),
         any(filter(file.parse_eml(.).attachments,
                    .file_type in ("html", "svg")
             ),
             regex.count(file.parse_text(.).text,
                         'const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\s*='
             ) >= 3
             or (
               strings.icontains(file.parse_text(.).text, 'const baseDomain')
               and strings.icontains(file.parse_text(.).text, 'const port')
               and strings.icontains(file.parse_text(.).text, 'const path')
             )
             or strings.icontains(file.parse_text(.).text, 'impact?')
             or regex.contains(file.parse_text(.).text, '\d/impact')
         )
  )

  // direct body links
  or any(body.links,
         (
           strings.icontains(.href_url.url, "impact?session_")
           or strings.icontains(.href_url.url, "/impact")
         )
         and (
           strings.icontains(.href_url.url, ":8443")
           or strings.icontains(.href_url.url, ":2087")
         )
  )
)

Detection logic

Scope: inbound message.

Identifies the use of the Impact Solutions PhaaS. Impact Vector Suite is a full-spectrum payload delivery platform, engineered for stealth-optimized execution across all major deployment vectors.

inbound message
any of:
- any of filter(attachments) where any holds:
  - regex.count(file.parse_text(.).text, 'const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\\s*=') ≥ 3
  - all of:
    
    file.parse_text(.).text contains 'const baseDomain'
    file.parse_text(.).text contains 'const port'
    file.parse_text(.).text contains 'const path'
  - file.parse_text(.).text contains 'impact?'
  - file.parse_text(.).text matches '\\d/impact'
- any of filter(attachments) where:
  - any of filter(...) where any holds:
    
    regex.count(file.parse_text(.).text, 'const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\\s*=') ≥ 3
    all of:
    
    file.parse_text(.).text contains 'const baseDomain'
    file.parse_text(.).text contains 'const port'
    file.parse_text(.).text contains 'const path'
    file.parse_text(.).text contains 'impact?'
    file.parse_text(.).text matches '\\d/impact'
- any of body.links where all hold:
  - any of:
    
    .href_url.url contains 'impact?session_'
    .href_url.url contains '/impact'
  - any of:
    
    .href_url.url contains ':8443'
    .href_url.url contains ':2087'

Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, body.links, body.links[].href_url.url, type.inbound. Sensors: file.parse_eml, file.parse_text, regex.contains, regex.count, strings.icontains.

Indicators matched (16)

Field	Match	Value
`attachments[].file_type`	member	`html`
`attachments[].file_type`	member	`svg`
`regex.count`	regex	`const (?:urlParts\|fakeEvent\|progressBar\|progressInterval\|segments\|statusText\|statusText\|securityNotice\|statusMessages\|challengeForm\|challengeRunning\|challengeSuccess\|successText\|verifyingText\|encodedTarget\|baseDomain\|newDynamicParam\|statusElement)\s*=`
`strings.icontains`	substring	`const baseDomain`
`strings.icontains`	substring	`const port`
`strings.icontains`	substring	`const path`
`strings.icontains`	substring	`impact?`
`regex.contains`	regex	`\d/impact`
`attachments[].content_type`	equals	`message/rfc822`
`attachments[].file_extension`	equals	`eml`
`file.parse_eml(filter(attachments)[]).attachments[].file_type`	member	`html`
`file.parse_eml(filter(attachments)[]).attachments[].file_type`	member	`svg`

4 more

`strings.icontains`	substring	`impact?session_`
`strings.icontains`	substring	`/impact`
`strings.icontains`	substring	`:8443`
`strings.icontains`	substring	`:2087`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(filter(attachments))
      any(filter(...))
        or
          and
            file.parse_text(filter(...)[]).text contains "const baseDomain"
            file.parse_text(filter(...)[]).text contains "const path"
            file.parse_text(filter(...)[]).text contains "const port"
          file.parse_text(filter(...)[]).text contains "impact?"
          file.parse_text(filter(...)[]).text regex_match "\\d/impact"
          regex.count func_call "regex.count(file.parse_text(filter(...)[]).text, \"const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\\s*=\") >= 3"
    any(body.links)
      and
        or
          body.links.href_url.url contains "/impact"
          body.links.href_url.url contains "impact?session_"
        or
          body.links.href_url.url contains ":2087"
          body.links.href_url.url contains ":8443"
    any(filter(attachments))
      or
        and
          file.parse_text(filter(attachments)[]).text contains "const baseDomain"
          file.parse_text(filter(attachments)[]).text contains "const path"
          file.parse_text(filter(attachments)[]).text contains "const port"
        file.parse_text(filter(attachments)[]).text contains "impact?"
        file.parse_text(filter(attachments)[]).text regex_match "\\d/impact"
        regex.count func_call "regex.count(file.parse_text(filter(attachments)[]).text, \"const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\\s*=\") >= 3"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`