Detection rules › Sublime MQL
Service abuse: SendGrid-formatted link with actor-controlled fragment
Detects messages containing SendGrid or SendGrid-like links with base64-encoded zlib-compressed JSON in the URL fragment, indicating potential abuse of legitimate email services for malicious purposes.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and length(body.links) < 10
and any(body.links,
// SendGrid or SendGrid-like links have been abused
(
.href_url.path == "/ls/click"
or any(.href_url.query_params_decoded['upn'], . is not null)
)
// base64-encoded zlib-compressed JSON
and regex.match(.href_url.fragment, 'eJy.{7}A.*')
)
Detection logic
Scope: inbound message.
Detects messages containing SendGrid or SendGrid-like links with base64-encoded zlib-compressed JSON in the URL fragment, indicating potential abuse of legitimate email services for malicious purposes.
- inbound message
- length(body.links) < 10
any of
body.linkswhere all hold:any of:
- .href_url.path is '/ls/click'
any of
.href_url.query_params_decoded['upn']where:- . is set
- .href_url.fragment matches 'eJy.{7}A.*'
Inspects: body.links, body.links[].href_url.fragment, body.links[].href_url.path, body.links[].href_url.query_params_decoded['upn'], type.inbound. Sensors: regex.match.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.path | equals | /ls/click |
regex.match | regex | eJy.{7}A.* |