Detection rules › Sublime MQL
Credential phishing: Blue button styled link with file-sharing template artifacts
Detects inbound messages containing styled blue button links commonly associated with generic file-sharing phishing templates, where the link does not point to legitimate Outlook domains.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
Rule body MQL
type.inbound
and (
// no previous threads
length(body.previous_threads) == 0
// or is a fake thread
or (
(length(headers.references) == 0 or headers.in_reply_to is null)
and (
subject.is_reply
or subject.is_forward
or length(body.previous_threads) > 0
)
)
)
and any(filter(html.xpath(body.html, '//a[@href]').nodes,
// blue button background, background-color and observed colors
regex.icontains(.raw,
'(?:background(?:-color)?)\s*[:\s]\s*#(?:0078d4|3a78d1)'
)
),
(
// it's styled as a button
regex.icontains(.raw, 'padding')
)
// ignore links going to microsoft
and not any(.links,
(
.href_url.domain.sld in (
"microsoft",
"azure",
"outlook.office365",
"office365"
)
)
or .href_url.domain.domain in $tenant_domains
or (
.href_url.domain.root_domain in (
"mimecast.com",
"mimecastprotect.com"
)
and any(.href_url.query_params_decoded['domain'],
strings.parse_domain(.).domain in (
"microsoft.com",
"azure.com",
"outlook.office365.com",
"office365.com"
)
or strings.parse_domain(.).domain in $tenant_domains
)
)
)
)
and any(ml.nlu_classifier(body.current_thread.text).intents, .name != "benign")
// negate attachments that contain the known microsoft content type
and not any(attachments,
strings.icontains(.content_type, 'x-microsoft-rpmsg-message')
)
// negate microsoft emails who pass auth
and not (
sender.email.domain.root_domain == "microsoft.com"
and headers.auth_summary.dmarc.pass
)
Detection logic
Scope: inbound message.
Detects inbound messages containing styled blue button links commonly associated with generic file-sharing phishing templates, where the link does not point to legitimate Outlook domains.
- inbound message
any of:
- length(body.previous_threads) is 0
all of:
any of:
- length(headers.references) is 0
- headers.in_reply_to is missing
any of:
- subject.is_reply
- subject.is_forward
- length(body.previous_threads) > 0
any of
filter(...)where all hold:- .raw matches 'padding'
not:
any of
.linkswhere any holds:- .href_url.domain.sld in ('microsoft', 'azure', 'outlook.office365', 'office365')
- .href_url.domain.domain in $tenant_domains
all of:
- .href_url.domain.root_domain in ('mimecast.com', 'mimecastprotect.com')
any of
.href_url.query_params_decoded['domain']where any holds:- strings.parse_domain(.).domain in ('microsoft.com', 'azure.com', 'outlook.office365.com', 'office365.com')
- strings.parse_domain(.).domain in $tenant_domains
any of
ml.nlu_classifier(body.current_thread.text).intentswhere:- .name is not 'benign'
not:
any of
attachmentswhere:- .content_type contains 'x-microsoft-rpmsg-message'
not:
all of:
- sender.email.domain.root_domain is 'microsoft.com'
- headers.auth_summary.dmarc.pass
Inspects: attachments[].content_type, body.current_thread.text, body.html, body.previous_threads, headers.auth_summary.dmarc.pass, headers.in_reply_to, headers.references, sender.email.domain.root_domain, subject.is_forward, subject.is_reply, type.inbound. Sensors: html.xpath, ml.nlu_classifier, regex.icontains, strings.icontains, strings.parse_domain. Reference lists: $tenant_domains.
Indicators matched (10)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | (?:background(?:-color)?)\s*[:\s]\s*#(?:0078d4|3a78d1) |
regex.icontains | regex | padding |
filter(...)[].links[].href_url.domain.sld | member | microsoft |
filter(...)[].links[].href_url.domain.sld | member | azure |
filter(...)[].links[].href_url.domain.sld | member | outlook.office365 |
filter(...)[].links[].href_url.domain.sld | member | office365 |
filter(...)[].links[].href_url.domain.root_domain | member | mimecast.com |
filter(...)[].links[].href_url.domain.root_domain | member | mimecastprotect.com |
strings.icontains | substring | x-microsoft-rpmsg-message |
sender.email.domain.root_domain | equals | microsoft.com |