Detection rules › Sublime MQL

Sublime MQL rules: phishing

Rule	Severity
Credential phishing: Blue button styled link with file-sharing template artifacts	`low`
Credential phishing: Personalized document signing request	`medium`

Credential phishing: Blue button styled link with file-sharing template artifacts

Severity: low
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects inbound messages containing styled blue button links commonly associated with generic file-sharing phishing templates, where the link does not point to legitimate Outlook domains.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	Impersonation: Brand, Social engineering

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

attachments
body
body.current_thread
headers
headers.auth_summary
sender.email
subject
type

Rule body

type.inbound
and (
  // no previous threads
  length(body.previous_threads) == 0
  // or is a fake thread
  or (
    (length(headers.references) == 0 or headers.in_reply_to is null)
    and (
      subject.is_reply
      or subject.is_forward
      or length(body.previous_threads) > 0
    )
  )
)
and any(filter(html.xpath(body.html,
                          // require some styling anywhere in the anchor before running the
                          // (comparatively expensive) regex checks below
                          '//a[@href][@style or .//@style]'
               ).nodes,
               // blue button background, background-color and observed colors
               regex.icontains(.raw,
                               '(?:background(?:-color)?)\s*[:\s]\s*#(?:0078d4|3a78d1)'
               )
        ),
        (
          // it's styled as a button
          regex.icontains(.raw, 'padding')
        )
        // ignore links going to microsoft
        and not any(.links,
                    (
                      .href_url.domain.sld in (
                        "microsoft",
                        "azure",
                        "outlook.office365",
                        "office365"
                      )
                    )
                    or .href_url.domain.domain in $tenant_domains
                    or (
                      .href_url.domain.root_domain in (
                        "mimecast.com",
                        "mimecastprotect.com"
                      )
                      and any(.href_url.query_params_decoded['domain'],
                              strings.parse_domain(.).domain in (
                                "microsoft.com",
                                "azure.com",
                                "outlook.office365.com",
                                "office365.com"
                              )
                              or strings.parse_domain(.).domain in $tenant_domains
                      )
                    )
        )
)
and any(ml.nlu_classifier(body.current_thread.text).intents, .name != "benign")
// negate attachments that contain the known microsoft content type
and not any(attachments,
            strings.icontains(.content_type, 'x-microsoft-rpmsg-message')
)
// negate microsoft emails who pass auth
and not (
  sender.email.domain.root_domain == "microsoft.com"
  and headers.auth_summary.dmarc.pass
)

Detection logic

Scope: inbound message.

Detects inbound messages containing styled blue button links commonly associated with generic file-sharing phishing templates, where the link does not point to legitimate Outlook domains.

inbound message
any of:
- length(body.previous_threads) is 0
- all of:
  - any of:
    
    length(headers.references) is 0
    headers.in_reply_to is missing
  - any of:
    
    subject.is_reply
    subject.is_forward
    length(body.previous_threads) > 0
any of filter(...) where all hold:
- .raw matches 'padding'
- not:
  - any of .links where any holds:
    
    .href_url.domain.sld in ('microsoft', 'azure', 'outlook.office365', 'office365')
    .href_url.domain.domain in $tenant_domains
    all of:
    
    .href_url.domain.root_domain in ('mimecast.com', 'mimecastprotect.com')
    any of .href_url.query_params_decoded['domain'] where any holds:
    
    strings.parse_domain(.).domain in ('microsoft.com', 'azure.com', 'outlook.office365.com', 'office365.com')
    strings.parse_domain(.).domain in $tenant_domains
any of ml.nlu_classifier(body.current_thread.text).intents where:
- .name is not 'benign'
not:
- any of attachments where:
  - .content_type contains 'x-microsoft-rpmsg-message'
not:
- all of:
  - sender.email.domain.root_domain is 'microsoft.com'
  - headers.auth_summary.dmarc.pass

Inspects: attachments[].content_type, body.current_thread.text, body.html, body.previous_threads, headers.auth_summary.dmarc.pass, headers.in_reply_to, headers.references, sender.email.domain.root_domain, subject.is_forward, subject.is_reply, type.inbound. Sensors: html.xpath, ml.nlu_classifier, regex.icontains, strings.icontains, strings.parse_domain. Reference lists: $tenant_domains.

Indicators matched (2)

Field	Match	Value
`regex.icontains`	regex	`(?:background(?:-color)?)\s[:\s]\s#(?:0078d4\|3a78d1)`
`regex.icontains`	regex	`padding`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(filter(...))
    and
      not
        any(filter(...).links)
          or
            and
              any(filter(...).links.href_url.query_params_decoded['domain'])
                or
                  strings.parse_domain func_call "strings.parse_domain(filter(...)[].links[].href_url.query_params_decoded['domain'][]).domain in (microsoft.com, azure.com, outlook.office365.com, office365.com)"
                  strings.parse_domain func_call "strings.parse_domain(filter(...)[].links[].href_url.query_params_decoded['domain'][]).domain in tenant_domains"
              filter(...).links[].href_url.domain.root_domain in ["mimecast.com", "mimecastprotect.com"]
            filter(...).links[].href_url.domain.sld in ["azure", "microsoft", "office365", "outlook.office365"]
             macro "filter(...)[].links[].href_url.domain.domain in tenant_domains"
      filter(...).raw regex_match "padding"
  or
    and
      or
        body.previous_threads length_compare "0"
        subject.is_forward eq "true"
        subject.is_reply eq "true"
      or
        headers.in_reply_to is_null
        headers.references length_compare "0"
    body.previous_threads length_compare "0"
  not
    any(attachments)
      attachments.content_type contains "x-microsoft-rpmsg-message"
  not
    and
      headers.auth_summary.dmarc.pass eq "true"
      sender.email.domain.root_domain eq "microsoft.com"
  any(ml.nlu_classifier(body.current_thread.text).intents)
    ml.nlu_classifier(body.current_thread.text).intents.name ne "benign"
  type.inbound eq "true"

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`attachments`	array_any	(no value, null check)	`excludes:attachments`
`headers.auth_summary.dmarc.pass`	eq	`true`	`excludes:headers.auth_summary.dmarc.pass` `field:"headers.auth_summary.dmarc.pass" value:"true"`
`sender.email.domain.root_domain`	eq	`microsoft.com`	`excludes:sender.email.domain.root_domain` `field:"sender.email.domain.root_domain" value:"microsoft.com"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`headers.in_reply_to`	is_null	(no value, null check)	`field:"headers.in_reply_to" kind:is_null`
`subject.is_forward`	eq	`true` transforms: `boolean`	`field:"subject.is_forward" kind:eq value:"true"`
`subject.is_reply`	eq	`true` transforms: `boolean`	`field:"subject.is_reply" kind:eq value:"true"`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`

Credential phishing: Personalized document signing request

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects messages with a single recipient and personalized document signing requests. The rule identifies messages referencing DocuSign or document-related language, combined with domain-specific greeting patterns or known malicious HTML artifacts associated with fraudulent signing invitations from entities such as STAR Capital or Agito AS.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing, BEC/Fraud
Tactics and techniques	Impersonation: Brand, Social engineering

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

body
body.current_thread
body.html
recipients
recipients.to
type

Rule body

type.inbound
// personalized document form ensures recipients should always be 1
and length(recipients.to) == 1
and 2 of (
  // document/sign language
  strings.icontains(body.current_thread.text, 'docusign', 'document'),
  // greeting uses recipient's email local_part
  any(recipients.to,
      strings.icontains(body.current_thread.text,
                        strings.concat("You're receiving this on behalf of ",
                                       .email.domain.sld
                        )
      )
      or strings.icontains(body.current_thread.text,
                           strings.concat("Invitation to sign document for ",
                                          .email.domain.sld
                           )
      )
  ),
  // templated html artifact
  strings.contains(body.html.raw,
                   'STAR Capital invites you to exchange',
                   'Reminder: Invitation to sign document for Agito AS'
  )
)

Detection logic

Scope: inbound message.

inbound message
length(recipients.to) is 1
at least 2 of:
- body.current_thread.text contains any of 2 patterns
  - docusign
  - document
- any of recipients.to where any holds:
  - strings.icontains(body.current_thread.text)
  - strings.icontains(body.current_thread.text)
- body.html.raw contains any of 2 patterns
  - STAR Capital invites you to exchange
  - Reminder: Invitation to sign document for Agito AS

Inspects: body.current_thread.text, body.html.raw, recipients.to, recipients.to[].email.domain.sld, type.inbound. Sensors: strings.concat, strings.contains, strings.icontains.

Indicators matched (4)

Field	Match	Value
`strings.icontains`	substring	`docusign`
`strings.icontains`	substring	`document`
`strings.contains`	substring	`STAR Capital invites you to exchange`
`strings.contains`	substring	`Reminder: Invitation to sign document for Agito AS`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    any(recipients.to)
      strings.icontains func_call "strings.icontains(body.current_thread.text)"
    body.current_thread.text contains "document"
    body.current_thread.text contains "docusign"
    body.html.raw contains "Reminder: Invitation to sign document for Agito AS"
    body.html.raw contains "STAR Capital invites you to exchange"
  recipients.to length_compare "1"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`body.current_thread.text`	contains	`document` `docusign`	`field:"body.current_thread.text" kind:contains`
`body.html.raw`	contains	`Reminder: Invitation to sign document for Agito AS` `STAR Capital invites you to exchange`	`field:"body.html.raw" kind:contains`
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`

Sublime MQL rules: phishing

Credential phishing: Blue button styled link with file-sharing template artifacts

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (2)

Stages and Predicates

Stage 1: mql_rule

Exclusions

Indicators

Credential phishing: Personalized document signing request

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (4)

Stages and Predicates

Stage 1: mql_rule

Indicators

Stage 1: `mql_rule`

Stage 1: `mql_rule`