Detection rules › Sublime MQL
Service abuse: Square marketing with suspicious QR code
Detects messages from Square's marketing domain containing QR codes that redirect to self-service creation platforms, file sharing services, or image hosting services.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | QR code, Free file host |
Event coverage
| Message attribute |
|---|
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.domain.domain == "squaremktg.com"
and beta.scan_qr(file.message_screenshot()).found
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta feature in custom rules is not suggested until it has been formally released
//
and any(filter(beta.scan_qr(file.message_screenshot()).items,
// ignore square's own free website hosting service
.url.domain.root_domain != "square.site"
),
(
.url.domain.root_domain in $self_service_creation_platform_domains
or .url.domain.domain in $self_service_creation_platform_domains
)
or (
.url.domain.root_domain in $free_file_hosts
or .url.domain.domain in $free_file_hosts
)
)
Detection logic
Scope: inbound message.
Detects messages from Square's marketing domain containing QR codes that redirect to self-service creation platforms, file sharing services, or image hosting services.
- inbound message
- sender.email.domain.domain is 'squaremktg.com'
- beta.scan_qr(file.message_screenshot()).found
any of
filter(...)where any holds:any of:
- .url.domain.root_domain in $self_service_creation_platform_domains
- .url.domain.domain in $self_service_creation_platform_domains
any of:
- .url.domain.root_domain in $free_file_hosts
- .url.domain.domain in $free_file_hosts
Inspects: sender.email.domain.domain, type.inbound. Sensors: beta.scan_qr, file.message_screenshot. Reference lists: $free_file_hosts, $self_service_creation_platform_domains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
sender.email.domain.domain | equals | squaremktg.com |