Detection rules › Sublime MQL
Link: Spam website with evasion indicators
Detects messages containing links to spam websites that show signs of evasion techniques, including blocklisted IP provider messages or rate limiting responses when analyzed.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Spam |
| Tactics and techniques | Evasion |
Event coverage
Rule body MQL
type.inbound
// single meaningful root domain in links
and length(filter(distinct(body.links, .href_url.domain.root_domain),
// filter out unrelated domains
.href_url.domain.root_domain != sender.email.domain.root_domain
and any(recipients.to,
.email.domain.root_domain != ..href_url.domain.root_domain
)
and .href_url.domain.root_domain not in ("aka.ms")
)
) == 1
// specific spam website pattern
and any(body.links,
// did not redirect to any other domain
ml.link_analysis(.).effective_url.domain.domain == .href_url.domain.domain
and (
// LinkAnalysis was "evaded"
any(ml.link_analysis(.).effective_url.query_params_decoded["q"],
strings.icontains(., "IP provider is blacklisted!")
)
// or we encountered the rate limiting
or ml.link_analysis(.).final_dom.inner_text == "Too Many Requests!"
)
)
Detection logic
Scope: inbound message.
Detects messages containing links to spam websites that show signs of evasion techniques, including blocklisted IP provider messages or rate limiting responses when analyzed.
- inbound message
- length(filter(distinct(body.links, .href_url.domain.root_domain), .href_url.domain.root_domain != sender.email.domain.root_domain and any(recipients.to, .email.domain.root_domain != ..href_url.domain.root_domain) and .href_url.domain.root_domain not in ('aka.ms'))) is 1
any of
body.linkswhere all hold:- ml.link_analysis(.).effective_url.domain.domain is .href_url.domain.domain
any of:
any of
ml.link_analysis(.).effective_url.query_params_decoded['q']where:- . contains 'IP provider is blacklisted!'
- ml.link_analysis(.).final_dom.inner_text is 'Too Many Requests!'
Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, recipients.to, recipients.to[].email.domain.root_domain, sender.email.domain.root_domain, type.inbound. Sensors: ml.link_analysis, strings.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
distinct(body.links)[].href_url.domain.root_domain | member | aka.ms |
strings.icontains | substring | IP provider is blacklisted! |