Detection rules › Sublime MQL

Link: Breely link masquerading as PDF

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing a single Breely link that displays as a PDF file. Typically, redirects to a different destination for malicious purposes.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesFree subdomain host, Social engineering

Event coverage

Rule body MQL

type.inbound
and length(filter(body.links, .href_url.domain.root_domain == "breely.com")) == 1
and any(body.links,
        .href_url.domain.root_domain == "breely.com"
        and strings.icontains(.display_text, ".pdf")
)

Detection logic

Scope: inbound message.

Detects messages containing a single Breely link that displays as a PDF file. Typically, redirects to a different destination for malicious purposes.

  1. inbound message
  2. length(filter(body.links, .href_url.domain.root_domain == 'breely.com')) is 1
  3. any of body.links where all hold:
    • .href_url.domain.root_domain is 'breely.com'
    • .display_text contains '.pdf'

Inspects: body.links, body.links[].display_text, body.links[].href_url.domain.root_domain, type.inbound. Sensors: strings.icontains.

Indicators matched (2)

FieldMatchValue
body.links[].href_url.domain.root_domainequalsbreely.com
strings.icontainssubstring.pdf