detection.wiki

Detection rules › Sublime MQL

Link: Free subdomain host with undisclosed recipients

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages with undisclosed recipients, containing links to free subdomain hosts

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Tactics and techniquesFree subdomain host

Event coverage

Message attribute
body
body.current_thread
body.links (collection)
headers (collection)
headers.hops (collection)
recipients
recipients.to (collection)
type

Rule body MQL

type.inbound
and any(body.links,
        .href_url.domain.root_domain in $free_subdomain_hosts
        and .href_url.domain.subdomain is not null
        and .href_url.domain.subdomain != "www"
        and not (
          .href_url.domain.root_domain == "googleusercontent.com"
          and strings.istarts_with(.href_url.path, "/mail-sig")
        )
)
and (
  length(recipients.to) == 0
  or all(recipients.to, .display_name == "Undisclosed recipients")
)
and length(recipients.cc) == 0
and length(recipients.bcc) == 0

// negate listmailers & benign threads
and not (
  any(headers.hops, any(.fields, .name == "List-Unsubscribe"))
  or any(ml.nlu_classifier(body.current_thread.text).intents,
         .name == "benign" and .confidence == "high"
  )
)
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or profile.by_sender().any_messages_malicious_or_spam
)
and not profile.by_sender().any_messages_benign

Detection logic

Scope: inbound message.

Detects messages with undisclosed recipients, containing links to free subdomain hosts

  1. inbound message
  2. any of body.links where all hold:
    • .href_url.domain.root_domain in $free_subdomain_hosts
    • .href_url.domain.subdomain is set
    • .href_url.domain.subdomain is not 'www'
    • not:
      • all of:
        • .href_url.domain.root_domain is 'googleusercontent.com'
        • .href_url.path starts with '/mail-sig'
  3. any of:
    • length(recipients.to) is 0
    • all of recipients.to where:
      • .display_name is 'Undisclosed recipients'
  4. length(recipients.cc) is 0
  5. length(recipients.bcc) is 0
  6. none of:
    • any of headers.hops where:
      • any of .fields where:
        • .name is 'List-Unsubscribe'
    • any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
      • .name is 'benign'
      • .confidence is 'high'
  7. any of:
    • profile.by_sender().prevalence in ('new', 'outlier')
    • profile.by_sender().any_messages_malicious_or_spam
  8. not:
    • profile.by_sender().any_messages_benign

Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.subdomain, body.links[].href_url.path, headers.hops, headers.hops[].fields, headers.hops[].fields[].name, recipients.bcc, recipients.cc, recipients.to, recipients.to[].display_name, type.inbound. Sensors: ml.nlu_classifier, profile.by_sender, strings.istarts_with. Reference lists: $free_subdomain_hosts.

Indicators matched (6)

FieldMatchValue
body.links[].href_url.domain.root_domainequalsgoogleusercontent.com
strings.istarts_withprefix/mail-sig
recipients.to[].display_nameequalsUndisclosed recipients
headers.hops[].fields[].nameequalsList-Unsubscribe
ml.nlu_classifier(body.current_thread.text).intents[].nameequalsbenign
ml.nlu_classifier(body.current_thread.text).intents[].confidenceequalshigh