Detection rules › Sublime MQL
Service abuse: Suspicious Datadog alert
Message from alert@dtdg.co containing links to URL shorteners or self-service creation platforms.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion, Free subdomain host |
Event coverage
| Message attribute |
|---|
| body |
| body.current_thread |
| body.links (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.email == "alert@dtdg.co"
and length(body.current_thread.text) < 1000
and (
(
any(filter(body.links,
.parser == "hyperlink"
and not any(.href_url.query_params_decoded["domain"],
strings.parse_domain(.).root_domain == "datadoghq.com"
)
),
.href_url.domain.root_domain != "datadoghq.com"
and .href_url.domain.root_domain != "aka.ms"
)
and regex.icontains(body.current_thread.text,
'quarantine|held for.{0,10}review|secure message|voice\s?mail'
)
)
or (
ml.nlu_classifier(body.current_thread.text).language == "english"
and any(ml.nlu_classifier(body.current_thread.text).topics,
.confidence == "high"
and .name == "Voicemail Call and Missed Call Notifications"
)
)
)
Detection logic
Scope: inbound message.
Message from alert@dtdg.co containing links to URL shorteners or self-service creation platforms.
- inbound message
- sender.email.email is 'alert@dtdg.co'
- length(body.current_thread.text) < 1000
any of:
all of:
any of
filter(body.links)where all hold:- .href_url.domain.root_domain is not 'datadoghq.com'
- .href_url.domain.root_domain is not 'aka.ms'
- body.current_thread.text matches 'quarantine|held for.{0,10}review|secure message|voice\\s?mail'
all of:
- ml.nlu_classifier(body.current_thread.text).language is 'english'
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .confidence is 'high'
- .name is 'Voicemail Call and Missed Call Notifications'
Inspects: body.current_thread.text, body.links, body.links[].href_url.query_params_decoded['domain'], body.links[].parser, sender.email.email, type.inbound. Sensors: ml.nlu_classifier, regex.icontains, strings.parse_domain.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
sender.email.email | equals | alert@dtdg.co |
body.links[].parser | equals | hyperlink |
regex.icontains | regex | quarantine|held for.{0,10}review|secure message|voice\s?mail |
ml.nlu_classifier(body.current_thread.text).topics[].confidence | equals | high |
ml.nlu_classifier(body.current_thread.text).topics[].name | equals | Voicemail Call and Missed Call Notifications |