Detection rules › Sublime MQL

Sublime MQL rules: phaas

Rule	Severity
PhaaS: Impact Solutions (Impact Vector Suite)	`medium`

PhaaS: Impact Solutions (Impact Vector Suite)

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

Identifies the use of the Impact Solutions PhaaS. Impact Vector Suite is a full-spectrum payload delivery platform, engineered for stealth-optimized execution across all major deployment vectors.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	Evasion

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

attachments
body
body.links
type

Rule Body

type.inbound
and (
  // attached html/svg
  any(filter(attachments, .file_type in ("html", "svg")),
      regex.count(file.parse_text(.).text,
                  'const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\s*='
      ) >= 3
      or (
        strings.icontains(file.parse_text(.).text, 'const baseDomain')
        and strings.icontains(file.parse_text(.).text, 'const port')
        and strings.icontains(file.parse_text(.).text, 'const path')
      )
      or strings.icontains(file.parse_text(.).text, 'impact?')
      or regex.contains(file.parse_text(.).text, '\d/impact')
  )

  // attached EMLs with html/svg attachments
  or any(filter(attachments,
                .content_type == "message/rfc822" or .file_extension == "eml"
         ),
         any(filter(file.parse_eml(.).attachments,
                    .file_type in ("html", "svg")
             ),
             regex.count(file.parse_text(.).text,
                         'const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\s*='
             ) >= 3
             or (
               strings.icontains(file.parse_text(.).text, 'const baseDomain')
               and strings.icontains(file.parse_text(.).text, 'const port')
               and strings.icontains(file.parse_text(.).text, 'const path')
             )
             or strings.icontains(file.parse_text(.).text, 'impact?')
             or regex.contains(file.parse_text(.).text, '\d/impact')
         )
  )

  // direct body links
  or any(body.links,
         (
           strings.icontains(.href_url.url, "impact?session_")
           or strings.icontains(.href_url.url, "/impact")
         )
         and (
           strings.icontains(.href_url.url, ":8443")
           or strings.icontains(.href_url.url, ":2087")
         )
  )
)

Detection Logic

Scope: inbound message.

Identifies the use of the Impact Solutions PhaaS. Impact Vector Suite is a full-spectrum payload delivery platform, engineered for stealth-optimized execution across all major deployment vectors.

inbound message
any of:
- any(filter(attachments, .file_type in ("html", "svg")), regex.count(file.parse_text(.).text, 'const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\s*=' ) >= 3 or ( strings.icontains(file.parse_text(.).text, 'const baseDomain') and strings.icontains(file.parse_text(.).text, 'const port') and strings.icontains(file.parse_text(.).text, 'const path') ) or strings.icontains(file.parse_text(.).text, 'impact?') or regex.contains(file.parse_text(.).text, '\d/impact') )
- any(filter(attachments, .content_type == "message/rfc822" or .file_extension == "eml" ), any(filter(file.parse_eml(.).attachments, .file_type in ("html", "svg") ), regex.count(file.parse_text(.).text, 'const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\s*=' ) >= 3 or ( strings.icontains(file.parse_text(.).text, 'const baseDomain') and strings.icontains(file.parse_text(.).text, 'const port') and strings.icontains(file.parse_text(.).text, 'const path') ) or strings.icontains(file.parse_text(.).text, 'impact?') or regex.contains(file.parse_text(.).text, '\d/impact') ) )
- any of body.links where all hold:
  - any of:
    
    .href_url.url contains 'impact?session_'
    .href_url.url contains '/impact'
  - any of:
    
    .href_url.url contains ':8443'
    .href_url.url contains ':2087'

Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, body.links, body.links[].href_url.url, type.inbound. Sensors: file.parse_eml, file.parse_text, regex.contains, regex.count, strings.icontains.

Indicators Matched (16)

Field	Match	Value
`attachments[].file_type`	member	`html`
`attachments[].file_type`	member	`svg`
`regex.count`	regex	`const (?:urlParts\|fakeEvent\|progressBar\|progressInterval\|segments\|statusText\|statusText\|securityNotice\|statusMessages\|challengeForm\|challengeRunning\|challengeSuccess\|successText\|verifyingText\|encodedTarget\|baseDomain\|newDynamicParam\|statusElement)\s*=`
`strings.icontains`	substring	`const baseDomain`
`strings.icontains`	substring	`const port`
`strings.icontains`	substring	`const path`
`strings.icontains`	substring	`impact?`
`regex.contains`	regex	`\d/impact`
`attachments[].content_type`	equals	`message/rfc822`
`attachments[].file_extension`	equals	`eml`
`file.parse_eml(filter(attachments)[]).attachments[].file_type`	member	`html`
`file.parse_eml(filter(attachments)[]).attachments[].file_type`	member	`svg`

4 more

`strings.icontains`	substring	`impact?session_`
`strings.icontains`	substring	`/impact`
`strings.icontains`	substring	`:8443`
`strings.icontains`	substring	`:2087`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(body.links)
      and
        or
          body.links.href_url.url contains "/impact"
          body.links.href_url.url contains "impact?session_"
        or
          body.links.href_url.url contains ":2087"
          body.links.href_url.url contains ":8443"
     macro "any(filter(attachments, .file_type in (\"html\", \"svg\")),\n      regex.count(file.parse_text(.).text,\n                  'const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\\s*='\n      ) >= 3\n      or (\n        strings.icontains(file.parse_text(.).text, 'const baseDomain')\n        and strings.icontains(file.parse_text(.).text, 'const port')\n        and strings.icontains(file.parse_text(.).text, 'const path')\n      )\n      or strings.icontains(file.parse_text(.).text, 'impact?')\n      or regex.contains(file.parse_text(.).text, '\\d/impact')\n  )"
     macro "any(filter(attachments,\n                .content_type == \"message/rfc822\" or .file_extension == \"eml\"\n         ),\n         any(filter(file.parse_eml(.).attachments,\n                    .file_type in (\"html\", \"svg\")\n             ),\n             regex.count(file.parse_text(.).text,\n                         'const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\\s*='\n             ) >= 3\n             or (\n               strings.icontains(file.parse_text(.).text, 'const baseDomain')\n               and strings.icontains(file.parse_text(.).text, 'const port')\n               and strings.icontains(file.parse_text(.).text, 'const path')\n             )\n             or strings.icontains(file.parse_text(.).text, 'impact?')\n             or regex.contains(file.parse_text(.).text, '\\d/impact')\n         )\n  )"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean` corpus 1212 (mql 1212)	`field:"type.inbound" kind:eq value:"true"`

Back to all Sublime MQL rules