detection.wiki

Detection rules › Sublime MQL

Suspicious recipient pattern and language with low reputation link to login

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Message contains a suspicious recipient pattern, financial or urgent language, and a suspicious link, with a login page and confusable characters or multiple redirects.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesSocial engineering

Event coverage

Message attribute
body
body.current_thread
body.links (collection)
recipients
recipients.cc (collection)
recipients.to (collection)
sender.email
type

Rule body MQL

type.inbound
and any(body.links,
        (
          (
            .href_url.domain.root_domain not in $tranco_1m
            and .href_url.domain.valid
            and .href_url.domain.root_domain not in $org_domains
            and .href_url.domain.root_domain not in $high_trust_sender_root_domains
          )
          or .href_url.domain.tld in $suspicious_tlds
        )
        and (
          ml.link_analysis(.).credphish.contains_login
          and (
            ml.link_analysis(.).final_dom.display_text != strings.replace_confusables(ml.link_analysis(.
                                                                                      ).final_dom.display_text
            )
            or length(ml.link_analysis(.).redirect_history) > 1
          )
        )
)
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name in ("financial", "urgency")
)
and (
  (
    length(recipients.to) == 0
    or length(recipients.bcc) > 0
    or (
      all(recipients.to, .email.domain.valid == false)
      and all(recipients.cc, .email.domain.valid == false)
    )
  )
)
and all(body.links,
        .href_url.domain.root_domain != sender.email.domain.root_domain
)

Detection logic

Scope: inbound message.

Message contains a suspicious recipient pattern, financial or urgent language, and a suspicious link, with a login page and confusable characters or multiple redirects.

  1. inbound message
  2. any of body.links where all hold:
    • any of:
      • all of:
        • .href_url.domain.root_domain not in $tranco_1m
        • .href_url.domain.valid
        • .href_url.domain.root_domain not in $org_domains
        • .href_url.domain.root_domain not in $high_trust_sender_root_domains
      • .href_url.domain.tld in $suspicious_tlds
    • all of:
      • ml.link_analysis(.).credphish.contains_login
      • any of:
        • ml.link_analysis(.).final_dom.display_text is not strings.replace_confusables(ml.link_analysis(.).final_dom.display_text)
        • length(ml.link_analysis(.).redirect_history) > 1
  3. any of ml.nlu_classifier(body.current_thread.text).entities where:
    • .name in ('financial', 'urgency')
  4. any of:
    • length(recipients.to) is 0
    • length(recipients.bcc) > 0
    • all of:
      • all of recipients.to where:
        • .email.domain.valid is False
      • all of recipients.cc where:
        • .email.domain.valid is False
  5. all of body.links where:
    • .href_url.domain.root_domain is not sender.email.domain.root_domain

Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.tld, body.links[].href_url.domain.valid, recipients.bcc, recipients.cc, recipients.cc[].email.domain.valid, recipients.to, recipients.to[].email.domain.valid, sender.email.domain.root_domain, type.inbound. Sensors: ml.link_analysis, ml.nlu_classifier, strings.replace_confusables. Reference lists: $high_trust_sender_root_domains, $org_domains, $suspicious_tlds, $tranco_1m.

Indicators matched (2)

FieldMatchValue
ml.nlu_classifier(body.current_thread.text).entities[].namememberfinancial
ml.nlu_classifier(body.current_thread.text).entities[].namememberurgency