Detection rules › Sublime MQL
Service abuse: Linode Objects HTML file hosting
Detects inbound messages containing links to HTML files hosted on Linode's object storage service (linodeobjects.com). This pattern is commonly used to host malicious content or bypass security controls by leveraging legitimate cloud storage infrastructure.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Free file host, Evasion |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| type |
Rule body MQL
type.inbound
and any(body.current_thread.links,
.href_url.domain.root_domain == "linodeobjects.com"
and strings.iends_with(.href_url.path, ".html")
)
Detection logic
Scope: inbound message.
Detects inbound messages containing links to HTML files hosted on Linode's object storage service (linodeobjects.com). This pattern is commonly used to host malicious content or bypass security controls by leveraging legitimate cloud storage infrastructure.
- inbound message
any of
body.current_thread.linkswhere all hold:- .href_url.domain.root_domain is 'linodeobjects.com'
- .href_url.path ends with '.html'
Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.links[].href_url.path, type.inbound. Sensors: strings.iends_with.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
body.current_thread.links[].href_url.domain.root_domain | equals | linodeobjects.com |
strings.iends_with | suffix | .html |