Detection rules › Sublime MQL

Service abuse: SendGrid-formatted link with actor-controlled fragment

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing SendGrid or SendGrid-like links with base64-encoded zlib-compressed JSON in the URL fragment, indicating potential abuse of legitimate email services for malicious purposes.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Social engineering

Event coverage

Rule body MQL

type.inbound
and length(body.links) < 10
and any(body.links,
        // SendGrid or SendGrid-like links have been abused
        (
          .href_url.path == "/ls/click"
          or any(.href_url.query_params_decoded['upn'], . is not null)
        )
        // base64-encoded zlib-compressed JSON
        and regex.match(.href_url.fragment, 'eJy.{7}A.*')
)

Detection logic

Scope: inbound message.

Detects messages containing SendGrid or SendGrid-like links with base64-encoded zlib-compressed JSON in the URL fragment, indicating potential abuse of legitimate email services for malicious purposes.

  1. inbound message
  2. length(body.links) < 10
  3. any of body.links where all hold:
    • any of:
      • .href_url.path is '/ls/click'
      • any of .href_url.query_params_decoded['upn'] where:
        • . is set
    • .href_url.fragment matches 'eJy.{7}A.*'

Inspects: body.links, body.links[].href_url.fragment, body.links[].href_url.path, body.links[].href_url.query_params_decoded['upn'], type.inbound. Sensors: regex.match.

Indicators matched (2)

FieldMatchValue
body.links[].href_url.pathequals/ls/click
regex.matchregexeJy.{7}A.*