Detection rules › Sublime MQL
Spam: Link to blob.core.windows.net from new domain (<30d)
This rule detects messages containing a link to blob.core.windows.net from a sender domain less than 30 days old. There is a single recipient present, but the recipient is a random email address, and not someone at the organization.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
| Tactics and techniques | Free subdomain host |
Event coverage
Rule body MQL
type.inbound
and length(recipients.to) == 1
and any(recipients.to, .email.domain.root_domain not in $org_domains)
and network.whois(sender.email.domain).days_old < 30
and length(body.links) < 3
and any(body.links,
strings.ends_with(.href_url.domain.subdomain, "blob.core")
and .href_url.domain.root_domain == "windows.net"
)
and (
not profile.by_sender().solicited
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
This rule detects messages containing a link to blob.core.windows.net from a sender domain less than 30 days old. There is a single recipient present, but the recipient is a random email address, and not someone at the organization.
- inbound message
- length(recipients.to) is 1
any of
recipients.towhere:- .email.domain.root_domain not in $org_domains
- network.whois(sender.email.domain).days_old < 30
- length(body.links) < 3
any of
body.linkswhere all hold:- .href_url.domain.subdomain ends with 'blob.core'
- .href_url.domain.root_domain is 'windows.net'
any of:
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
not:
- profile.by_sender().any_messages_benign
Inspects: body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.subdomain, recipients.to, recipients.to[].email.domain.root_domain, sender.email.domain, type.inbound. Sensors: network.whois, profile.by_sender, strings.ends_with. Reference lists: $org_domains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
strings.ends_with | suffix | blob.core |
body.links[].href_url.domain.root_domain | equals | windows.net |