detection.wiki

Detection rules › Sublime MQL

Link: Single character path with credential theft body and self sender behavior or invalid recipient

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Message where the sender and recipient are the same or the recipient domain is invalid, contains a link with a single character path and no query parameters or fragments, and includes credential theft language.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Social engineering

Event coverage

Message attribute
body.current_thread
recipients
recipients.to (collection)
sender.email
type

Rule body MQL

type.inbound
// self sender or invaild recipent domain
and length(recipients.to) == 1
and (
  sender.email.email == recipients.to[0].email.email
  or recipients.to[0].email.domain.valid == false
)
// path contains 1 character
and any(body.current_thread.links,
        regex.imatch(.href_url.path, '\/[A-Za-z0-9]')
        and .href_url.query_params is null
        and .href_url.fragment is null
        and .display_url.url is null
)
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)

Detection logic

Scope: inbound message.

Message where the sender and recipient are the same or the recipient domain is invalid, contains a link with a single character path and no query parameters or fragments, and includes credential theft language.

  1. inbound message
  2. length(recipients.to) is 1
  3. any of:
    • sender.email.email is recipients.to[0].email.email
    • recipients.to[0].email.domain.valid is False
  4. any of body.current_thread.links where all hold:
    • .href_url.path matches '\\/[A-Za-z0-9]'
    • .href_url.query_params is missing
    • .href_url.fragment is missing
    • .display_url.url is missing
  5. any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
    • .name is 'cred_theft'
    • .confidence is not 'low'

Inspects: body.current_thread.links, body.current_thread.links[].display_url.url, body.current_thread.links[].href_url.fragment, body.current_thread.links[].href_url.path, body.current_thread.links[].href_url.query_params, body.current_thread.text, recipients.to, recipients.to[0].email.domain.valid, recipients.to[0].email.email, sender.email.email, type.inbound. Sensors: ml.nlu_classifier, regex.imatch.

Indicators matched (2)

FieldMatchValue
regex.imatchregex\/[A-Za-z0-9]
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscred_theft