Detection rules › Sublime MQL
SharePoint OTP for filename matching org name
Detects Microsoft One-Time Passcode (OTP) messages where the shared document’s filename matches the sending organization's name. This typically indicates the recipient has verified their email address and is about to access a SharePoint file. Matching the document name to the sender's org is a pattern observed in multi-stage credential phishing campaigns, where attackers use branded file names to increase credibility and lure users into interacting with malicious content.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
Rule body MQL
type.inbound
// Microsoft sender
and sender.email.domain.root_domain == "microsoft.com"
// message ID contains the proper format for OTP messeges
and (
(
strings.istarts_with(headers.message_id, '<OneTimePasscode-')
and strings.iends_with(headers.message_id, '@odspnotify>')
)
// deal with Google thinking the message ID is "broke"
or (
strings.icontains(headers.message_id, 'SMTPIN_ADDED_BROKEN')
and any(headers.hops,
any(.fields,
.name == "X-Google-Original-Message-ID"
and strings.istarts_with(.value, '<OneTimePasscode-')
and strings.iends_with(.value, '@odspnotify>')
)
)
)
)
// make sure the body has the phrase we need to get the document name
and strings.icontains(body.current_thread.text,
'For security purposes, you must enter the code below to verify your account to access'
)
// extract the filename and org name from the body and see if they are equal
and any(regex.iextract(body.current_thread.text,
'For security purposes, you must enter the code below to verify your account to access (?P<doc_name>.*)\. The code will only work for.*This email is generated through (?P<org_name>.*)''s use of Microsoft 365\.'
),
.named_groups["doc_name"] =~ .named_groups["org_name"]
)
Detection logic
Scope: inbound message.
Detects Microsoft One-Time Passcode (OTP) messages where the shared document’s filename matches the sending organization's name. This typically indicates the recipient has verified their email address and is about to access a SharePoint file. Matching the document name to the sender's org is a pattern observed in multi-stage credential phishing campaigns, where attackers use branded file names to increase credibility and lure users into interacting with malicious content.
- inbound message
- sender.email.domain.root_domain is 'microsoft.com'
any of:
all of:
- headers.message_id starts with '<OneTimePasscode-'
- headers.message_id ends with '@odspnotify>'
all of:
- headers.message_id contains 'SMTPIN_ADDED_BROKEN'
any of
headers.hopswhere:any of
.fieldswhere all hold:- .name is 'X-Google-Original-Message-ID'
- .value starts with '<OneTimePasscode-'
- .value ends with '@odspnotify>'
- body.current_thread.text contains 'For security purposes, you must enter the code below to verify your account to access'
any of
regex.iextract(body.current_thread.text)where:- .named_groups['doc_name'] is .named_groups['org_name']
Inspects: body.current_thread.text, headers.hops, headers.hops[].fields, headers.hops[].fields[].name, headers.hops[].fields[].value, headers.message_id, sender.email.domain.root_domain, type.inbound. Sensors: regex.iextract, strings.icontains, strings.iends_with, strings.istarts_with.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | equals | microsoft.com |
strings.istarts_with | prefix | <OneTimePasscode- |
strings.iends_with | suffix | @odspnotify> |
strings.icontains | substring | SMTPIN_ADDED_BROKEN |
headers.hops[].fields[].name | equals | X-Google-Original-Message-ID |
strings.icontains | substring | For security purposes, you must enter the code below to verify your account to access |
regex.iextract | regex | For security purposes, you must enter the code below to verify your account to access (?P<doc_name>.*)\. The code will only work for.*This email is generated through (?P<org_name>.*)'s use of Microsoft 365\. |