Detection rules › Sublime MQL
Service abuse: SendThisFile with credential theft and financial language
Detects messages from sendthisfile.com containing credential theft language combined with financial communications topics.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Free file host, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| headers (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.domain.root_domain == "sendthisfile.com"
and any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "cred_theft" and .confidence != "low"
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
.name == "Financial Communications" and .confidence != "low"
)
// not a reply or forward
and (headers.in_reply_to is null or length(headers.references) == 0)
Detection logic
Scope: inbound message.
Detects messages from sendthisfile.com containing credential theft language combined with financial communications topics.
- inbound message
- sender.email.domain.root_domain is 'sendthisfile.com'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'cred_theft'
- .confidence is not 'low'
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .name is 'Financial Communications'
- .confidence is not 'low'
any of:
- headers.in_reply_to is missing
- length(headers.references) is 0
Inspects: body.current_thread.text, headers.in_reply_to, headers.references, sender.email.domain.root_domain, type.inbound. Sensors: ml.nlu_classifier.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | equals | sendthisfile.com |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | cred_theft |
ml.nlu_classifier(body.current_thread.text).topics[].name | equals | Financial Communications |