Detection rules › Sublime MQL
Sharepoint file share with suspicious recipients pattern
This rule detects messages originating from sharepoint.com with undisclosed recipients that are attempting to solicit the user to click a link. This has been observed in the event of an account compromise where the compromised account was utilizing legitimate file sharing services to share malicious links.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion |
Event coverage
Rule body MQL
type.inbound
// Suspicious recipient pattern
and any(recipients.to, .display_name == "Undisclosed recipients")
and strings.ilike(body.current_thread.text,
"*shared a file with you*",
"*shared with you*",
"*invited you to access a file*"
)
and strings.icontains(subject.subject, "shared")
and any(body.links, .href_url.domain.root_domain == "sharepoint.com")
Detection logic
Scope: inbound message.
This rule detects messages originating from sharepoint.com with undisclosed recipients that are attempting to solicit the user to click a link. This has been observed in the event of an account compromise where the compromised account was utilizing legitimate file sharing services to share malicious links.
- inbound message
any of
recipients.towhere:- .display_name is 'Undisclosed recipients'
body.current_thread.text matches any of 3 patterns
*shared a file with you**shared with you**invited you to access a file*
- subject.subject contains 'shared'
any of
body.linkswhere:- .href_url.domain.root_domain is 'sharepoint.com'
Inspects: body.current_thread.text, body.links, body.links[].href_url.domain.root_domain, recipients.to, recipients.to[].display_name, subject.subject, type.inbound. Sensors: strings.icontains, strings.ilike.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
recipients.to[].display_name | equals | Undisclosed recipients |
strings.ilike | substring | *shared a file with you* |
strings.ilike | substring | *shared with you* |
strings.ilike | substring | *invited you to access a file* |
strings.icontains | substring | shared |
body.links[].href_url.domain.root_domain | equals | sharepoint.com |