Detection rules › Sublime MQL
Unicode QR code
Identifies messages leveraging Unicode block characters (between U+2580 - U+259F) arranged on consecutive lines to create QR codes. The rule inspects both the overall quantity and specific formatting of these characters, while considering the sender's historical behavior and reputation.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| body.html |
| type |
Rule body MQL
type.inbound
// count of the lines ending with and then followed by a unicode block
and regex.count(body.html.inner_text,
'[\x{2580}-\x{259F}][^\S\r\n]*[\r\n][^\S\r\n]*[\x{2580}-\x{259F}]'
) > 10
// the total number of unicode blocks
and regex.count(body.current_thread.text, '[\x{2580}-\x{259F}]') > 150
and (
profile.by_sender_email().prevalence != "common"
or (
profile.by_sender_email().any_messages_malicious_or_spam
and not profile.by_sender_email().any_messages_benign
)
)
Detection logic
Scope: inbound message.
Identifies messages leveraging Unicode block characters (between U+2580 - U+259F) arranged on consecutive lines to create QR codes. The rule inspects both the overall quantity and specific formatting of these characters, while considering the sender's historical behavior and reputation.
- inbound message
- regex.count(body.html.inner_text, '[\\x{2580}-\\x{259F}][^\\S\\r\\n]*[\\r\\n][^\\S\\r\\n]*[\\x{2580}-\\x{259F}]') > 10
- regex.count(body.current_thread.text, '[\\x{2580}-\\x{259F}]') > 150
any of:
- profile.by_sender_email().prevalence is not 'common'
all of:
- profile.by_sender_email().any_messages_malicious_or_spam
not:
- profile.by_sender_email().any_messages_benign
Inspects: body.current_thread.text, body.html.inner_text, type.inbound. Sensors: profile.by_sender_email, regex.count.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
regex.count | regex | [\x{2580}-\x{259F}][^\S\r\n]*[\r\n][^\S\r\n]*[\x{2580}-\x{259F}] |
regex.count | regex | [\x{2580}-\x{259F}] |