Detection rules › Sublime MQL
PhaaS: Impact Solutions (Impact Vector Suite)
Identifies the use of the Impact Solutions PhaaS. Impact Vector Suite is a full-spectrum payload delivery platform, engineered for stealth-optimized execution across all major deployment vectors.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and (
// attached html/svg
any(filter(attachments, .file_type in ("html", "svg")),
regex.count(file.parse_text(.).text,
'const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\s*='
) >= 3
or (
strings.icontains(file.parse_text(.).text, 'const baseDomain')
and strings.icontains(file.parse_text(.).text, 'const port')
and strings.icontains(file.parse_text(.).text, 'const path')
)
or strings.icontains(file.parse_text(.).text, 'impact?')
or regex.contains(file.parse_text(.).text, '\d/impact')
)
// attached EMLs with html/svg attachments
or any(filter(attachments,
.content_type == "message/rfc822" or .file_extension == "eml"
),
any(filter(file.parse_eml(.).attachments,
.file_type in ("html", "svg")
),
regex.count(file.parse_text(.).text,
'const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\s*='
) >= 3
or (
strings.icontains(file.parse_text(.).text, 'const baseDomain')
and strings.icontains(file.parse_text(.).text, 'const port')
and strings.icontains(file.parse_text(.).text, 'const path')
)
or strings.icontains(file.parse_text(.).text, 'impact?')
or regex.contains(file.parse_text(.).text, '\d/impact')
)
)
// direct body links
or any(body.links,
(
strings.icontains(.href_url.url, "impact?session_")
or strings.icontains(.href_url.url, "/impact")
)
and (
strings.icontains(.href_url.url, ":8443")
or strings.icontains(.href_url.url, ":2087")
)
)
)
Detection logic
Scope: inbound message.
Identifies the use of the Impact Solutions PhaaS. Impact Vector Suite is a full-spectrum payload delivery platform, engineered for stealth-optimized execution across all major deployment vectors.
- inbound message
any of:
any of
filter(attachments)where any holds:- regex.count(file.parse_text(.).text, 'const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\\s*=') ≥ 3
all of:
- file.parse_text(.).text contains 'const baseDomain'
- file.parse_text(.).text contains 'const port'
- file.parse_text(.).text contains 'const path'
- file.parse_text(.).text contains 'impact?'
- file.parse_text(.).text matches '\\d/impact'
any of
filter(attachments)where:any of
filter(...)where any holds:- regex.count(file.parse_text(.).text, 'const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\\s*=') ≥ 3
all of:
- file.parse_text(.).text contains 'const baseDomain'
- file.parse_text(.).text contains 'const port'
- file.parse_text(.).text contains 'const path'
- file.parse_text(.).text contains 'impact?'
- file.parse_text(.).text matches '\\d/impact'
any of
body.linkswhere all hold:any of:
- .href_url.url contains 'impact?session_'
- .href_url.url contains '/impact'
any of:
- .href_url.url contains ':8443'
- .href_url.url contains ':2087'
Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, body.links, body.links[].href_url.url, type.inbound. Sensors: file.parse_eml, file.parse_text, regex.contains, regex.count, strings.icontains.
Indicators matched (16)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | member | html |
attachments[].file_type | member | svg |
regex.count | regex | const (?:urlParts|fakeEvent|progressBar|progressInterval|segments|statusText|statusText|securityNotice|statusMessages|challengeForm|challengeRunning|challengeSuccess|successText|verifyingText|encodedTarget|baseDomain|newDynamicParam|statusElement)\s*= |
strings.icontains | substring | const baseDomain |
strings.icontains | substring | const port |
strings.icontains | substring | const path |
strings.icontains | substring | impact? |
regex.contains | regex | \d/impact |
attachments[].content_type | equals | message/rfc822 |
attachments[].file_extension | equals | eml |
file.parse_eml(filter(attachments)[]).attachments[].file_type | member | html |
file.parse_eml(filter(attachments)[]).attachments[].file_type | member | svg |
4 more
strings.icontains | substring | impact?session_ |
strings.icontains | substring | /impact |
strings.icontains | substring | :8443 |
strings.icontains | substring | :2087 |