Detection rules › Sublime MQL
Service abuse: File sharing impersonation with external SharePoint links
Detects inbound messages claiming to share files or invite access, containing SharePoint or OneDrive links from external domains. The rule identifies suspicious sharing notifications where link display text matches the sender's name rather than a legitimate document name, indicating potential impersonation of legitimate file sharing services.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| sender |
| subject |
| type |
Rule body MQL
type.inbound
and strings.ilike(subject.subject, "*shared*", "*invit*")
and strings.ilike(body.current_thread.text,
"*shared a file with you*",
"*shared with you*",
"*invited you to access a file*"
)
and not strings.ilike(body.current_thread.text, "invited you to edit")
and (
any(filter(body.current_thread.links,
.href_url.domain.domain not in $tenant_domains
and (
.href_url.domain.root_domain == "sharepoint.com"
or .href_url.domain.root_domain == "1drv.ms"
or (
.href_url.domain.root_domain == 'mimecastprotect.com'
and strings.icontains(.href_url.query_params,
'.sharepoint.com'
)
)
)
and .display_text != "Open"
),
// check if the display_text exactly matches the sender's display name
.display_text == sender.display_name
)
)
Detection logic
Scope: inbound message.
Detects inbound messages claiming to share files or invite access, containing SharePoint or OneDrive links from external domains. The rule identifies suspicious sharing notifications where link display text matches the sender's name rather than a legitimate document name, indicating potential impersonation of legitimate file sharing services.
- inbound message
subject.subject matches any of 2 patterns
*shared**invit*
body.current_thread.text matches any of 3 patterns
*shared a file with you**shared with you**invited you to access a file*
not:
- body.current_thread.text matches 'invited you to edit'
any of
filter(body.current_thread.links)where:- .display_text is sender.display_name
Inspects: body.current_thread.links, body.current_thread.links[].display_text, body.current_thread.links[].href_url.domain.domain, body.current_thread.links[].href_url.domain.root_domain, body.current_thread.links[].href_url.query_params, body.current_thread.text, sender.display_name, subject.subject, type.inbound. Sensors: strings.icontains, strings.ilike. Reference lists: $tenant_domains.
Indicators matched (10)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | *shared* |
strings.ilike | substring | *invit* |
strings.ilike | substring | *shared a file with you* |
strings.ilike | substring | *shared with you* |
strings.ilike | substring | *invited you to access a file* |
strings.ilike | substring | invited you to edit |
body.current_thread.links[].href_url.domain.root_domain | equals | sharepoint.com |
body.current_thread.links[].href_url.domain.root_domain | equals | 1drv.ms |
body.current_thread.links[].href_url.domain.root_domain | equals | mimecastprotect.com |
strings.icontains | substring | .sharepoint.com |