Detection rules › Sublime MQL

Service abuse: Linode Objects HTML file hosting

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages containing links to HTML files hosted on Linode's object storage service (linodeobjects.com). This pattern is commonly used to host malicious content or bypass security controls by leveraging legitimate cloud storage infrastructure.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesFree file host, Evasion

Event coverage

Message attribute
body.current_thread
type

Rule body MQL

type.inbound
and any(body.current_thread.links,
        .href_url.domain.root_domain == "linodeobjects.com"
        and strings.iends_with(.href_url.path, ".html")
)

Detection logic

Scope: inbound message.

Detects inbound messages containing links to HTML files hosted on Linode's object storage service (linodeobjects.com). This pattern is commonly used to host malicious content or bypass security controls by leveraging legitimate cloud storage infrastructure.

  1. inbound message
  2. any of body.current_thread.links where all hold:
    • .href_url.domain.root_domain is 'linodeobjects.com'
    • .href_url.path ends with '.html'

Inspects: body.current_thread.links, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.links[].href_url.path, type.inbound. Sensors: strings.iends_with.

Indicators matched (2)

FieldMatchValue
body.current_thread.links[].href_url.domain.root_domainequalslinodeobjects.com
strings.iends_withsuffix.html