Detection rules › Sublime MQL
Service abuse: Mimecast URL with excessive path length
Detects messages containing the second stage Mimecast redirect URL with unusually long paths, potentially indicating abuse of the Mimecast URL redirection service to obfuscate malicious destinations.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion, Open redirect |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(body.links,
strings.icontains(.href_url.domain.root_domain, "mimecast")
and strings.starts_with(.href_url.path, "/r/")
),
length(.href_url.path) > 2000
)
Detection logic
Scope: inbound message.
Detects messages containing the second stage Mimecast redirect URL with unusually long paths, potentially indicating abuse of the Mimecast URL redirection service to obfuscate malicious destinations.
- inbound message
any of
filter(body.links)where:- length(.href_url.path) > 2000
Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.path, type.inbound. Sensors: strings.icontains, strings.starts_with.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | mimecast |
strings.starts_with | prefix | /r/ |