Detection rules › Sublime MQL
Link: Breely link masquerading as PDF
Detects messages containing a single Breely link that displays as a PDF file. Typically, redirects to a different destination for malicious purposes.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Free subdomain host, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and length(filter(body.links, .href_url.domain.root_domain == "breely.com")) == 1
and any(body.links,
.href_url.domain.root_domain == "breely.com"
and strings.icontains(.display_text, ".pdf")
)
Detection logic
Scope: inbound message.
Detects messages containing a single Breely link that displays as a PDF file. Typically, redirects to a different destination for malicious purposes.
- inbound message
- length(filter(body.links, .href_url.domain.root_domain == 'breely.com')) is 1
any of
body.linkswhere all hold:- .href_url.domain.root_domain is 'breely.com'
- .display_text contains '.pdf'
Inspects: body.links, body.links[].display_text, body.links[].href_url.domain.root_domain, type.inbound. Sensors: strings.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.root_domain | equals | breely.com |
strings.icontains | substring | .pdf |