Detection rules › Sublime MQL
Spam: Firebase password reset from suspicious sender
Detects Firebase password reset messages from suspicious or new senders that may be attempting to abuse the Firebase authentication service.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Spam |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.domain.root_domain == "firebaseapp.com"
and length(filter(body.links,
.href_url.domain.root_domain not in ("aka.ms")
and .href_url.path is not null
)
) == 1
and any(body.links,
.href_url.domain.domain == sender.email.domain.domain
and .href_url.path == "/__/auth/action"
and any(.href_url.query_params_decoded["mode"], . == "resetPassword")
)
and (
(
not profile.by_sender().solicited
and profile.by_sender().prevalence == "new"
)
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
or not headers.auth_summary.dmarc.pass
)
Detection logic
Scope: inbound message.
Detects Firebase password reset messages from suspicious or new senders that may be attempting to abuse the Firebase authentication service.
- inbound message
- sender.email.domain.root_domain is 'firebaseapp.com'
- length(filter(body.links, .href_url.domain.root_domain not in ('aka.ms') and .href_url.path is not null)) is 1
any of
body.linkswhere all hold:- .href_url.domain.domain is sender.email.domain.domain
- .href_url.path is '/__/auth/action'
any of
.href_url.query_params_decoded['mode']where:- . is 'resetPassword'
any of:
all of:
not:
- profile.by_sender().solicited
- profile.by_sender().prevalence is 'new'
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
not:
- headers.auth_summary.dmarc.pass
Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.path, body.links[].href_url.query_params_decoded['mode'], headers.auth_summary.dmarc.pass, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: profile.by_sender.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
sender.email.domain.root_domain | equals | firebaseapp.com |
body.links[].href_url.domain.root_domain | member | aka.ms |
body.links[].href_url.path | equals | /__/auth/action |
body.links[].href_url.query_params_decoded['mode'][] | equals | resetPassword |