Detection rules › Sublime MQL

Service abuse: SendThisFile with credential theft and financial language

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages from sendthisfile.com containing credential theft language combined with financial communications topics.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesFree file host, Social engineering

Event coverage

Rule body MQL

type.inbound
and sender.email.domain.root_domain == "sendthisfile.com"
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name == "Financial Communications" and .confidence != "low"
)
// not a reply or forward
and (headers.in_reply_to is null or length(headers.references) == 0)

Detection logic

Scope: inbound message.

Detects messages from sendthisfile.com containing credential theft language combined with financial communications topics.

  1. inbound message
  2. sender.email.domain.root_domain is 'sendthisfile.com'
  3. any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
    • .name is 'cred_theft'
    • .confidence is not 'low'
  4. any of ml.nlu_classifier(body.current_thread.text).topics where all hold:
    • .name is 'Financial Communications'
    • .confidence is not 'low'
  5. any of:
    • headers.in_reply_to is missing
    • length(headers.references) is 0

Inspects: body.current_thread.text, headers.in_reply_to, headers.references, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier.

Indicators matched (3)

FieldMatchValue
sender.email.domain.root_domainequalssendthisfile.com
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscred_theft
ml.nlu_classifier(body.current_thread.text).topics[].nameequalsFinancial Communications