Detection rules › Sublime MQL

Sublime MQL rules: unrelated

Rule	Severity
Sharepoint link likely unrelated to sender	`medium`

Sharepoint link likely unrelated to sender

Severity: medium
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects when a sender links to a Sharepoint file where the subdomain significantly differs from the sender's domain. The rule checks for OneNote, PDF, or unknown file types and includes various domain validation checks.

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	BEC/Fraud, Credential Phishing
Tactics and techniques	Impersonation: Employee, Lookalike domain, OneNote, PDF, Social engineering

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

body
body.html
body.links
headers
headers.auth_summary
sender.email
type

Rule Body

type.inbound
and any(beta.ml_topic(body.html.display_text).topics,
        .name == "File Sharing and Cloud Services" and .confidence == "high"
)
and 0 < length(body.links) < 10
and length(body.html.display_text) < 2000
and any(filter(body.links, .href_url.domain.root_domain == 'sharepoint.com'),
        // Normalize Levenshtein distance by string length (0 = identical, 0.7+ = different)
        // Working with what we have in MQL, considering we dont have max() or any other forms of string distancing
        (
          (
            strings.iends_with(.href_url.domain.subdomain,
                               '-my'
            ) // common Sharepoint subdomain suffix
            and (
              (
                strings.ilevenshtein(.href_url.domain.subdomain,
                                     sender.email.domain.sld
                ) - 3 // subtract aforementioned suffix for more accurate calculation
              ) / (
                (
                  (length(.href_url.domain.subdomain) - 3) + length(sender.email.domain.sld
                  )
 + (
                    (
                      (length(.href_url.domain.subdomain) - 3) - length(sender.email.domain.sld
                      )
                    ) + (
                      length(sender.email.domain.sld) - (
                        length(.href_url.domain.subdomain) - 3
                      )
                    )
                  )
                ) / 2.0 // to ensure we keep the result as a float
              )
            ) > 0.7 // customizable threshold
          )
          or (
            not strings.iends_with(.href_url.domain.subdomain,
                                   '-my'
            ) // no suffix, continue with original calculation
            and (
              strings.ilevenshtein(.href_url.domain.subdomain,
                                   sender.email.domain.sld
              ) / (
                (
                  length(.href_url.domain.subdomain) + length(sender.email.domain.sld
                  )
 + (
                    (
                      length(.href_url.domain.subdomain) - length(sender.email.domain.sld
                      )
                    ) + (
                      length(sender.email.domain.sld) - length(.href_url.domain.subdomain
                      )
                    )
                  )
                ) / 2.0 // to ensure we keep the result as a float
              )
            ) > 0.7 // customizable threshold
          )
        )
        and not strings.icontains(.href_url.path, sender.email.local_part)
        and not any($org_slds,
                    strings.icontains(..href_url.domain.subdomain, .)
        )

        // it is either a OneNote or PDF file, or unknown
        and regex.icontains(.href_url.path, '\/:[obu]:\/(?:p|g\/personal)')
)

// a way to negate long threads
// the full thread must be less than 6 times the length of the current thread
and length(body.html.inner_text) < 6 * length(body.current_thread.text)
and sender.email.domain.root_domain not in (
  "sharepoint.com",
  "sharepointonline.com"
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection Logic

Scope: inbound message.

inbound message
any(beta.ml_topic(body.html.display_text).topics, .name == "File Sharing and Cloud Services" and .confidence == "high" )
all of:
- (0) < (length(body.links))
- (length(body.links)) < (10)
length(body.html.display_text) < 2000
any(filter(body.links, .href_url.domain.root_domain == 'sharepoint.com'), // Normalize Levenshtein distance by string length (0 = identical, 0.7+ = different) // Working with what we have in MQL, considering we dont have max() or any other forms of string distancing ( ( strings.iends_with(.href_url.domain.subdomain, '-my' ) // common Sharepoint subdomain suffix and ( ( strings.ilevenshtein(.href_url.domain.subdomain, sender.email.domain.sld ) - 3 // subtract aforementioned suffix for more accurate calculation ) / ( ( (length(.href_url.domain.subdomain) - 3) + length(sender.email.domain.sld ) + ( ( (length(.href_url.domain.subdomain) - 3) - length(sender.email.domain.sld ) ) + ( length(sender.email.domain.sld) - ( length(.href_url.domain.subdomain) - 3 ) ) ) ) / 2.0 // to ensure we keep the result as a float ) ) > 0.7 // customizable threshold ) or ( not strings.iends_with(.href_url.domain.subdomain, '-my' ) // no suffix, continue with original calculation and ( strings.ilevenshtein(.href_url.domain.subdomain, sender.email.domain.sld ) / ( ( length(.href_url.domain.subdomain) + length(sender.email.domain.sld ) + ( ( length(.href_url.domain.subdomain) - length(sender.email.domain.sld ) ) + ( length(sender.email.domain.sld) - length(.href_url.domain.subdomain ) ) ) ) / 2.0 // to ensure we keep the result as a float ) ) > 0.7 // customizable threshold ) ) and not strings.icontains(.href_url.path, sender.email.local_part) and not any($org_slds, strings.icontains(..href_url.domain.subdomain, .) ) // it is either a OneNote or PDF file, or unknown and regex.icontains(.href_url.path, '\/:[obu]:\/(?:p|g\/personal)') )
length(body.html.inner_text) < 6 * length(body.current_thread.text)
sender.email.domain.root_domain not in ('sharepoint.com', 'sharepointonline.com')
any of:
- all of:
  - sender.email.domain.root_domain in $high_trust_sender_root_domains
  - not:
    
    headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: body.html.display_text, body.html.inner_text, body.links, body.links[].href_url.domain.root_domain, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, sender.email.local_part, type.inbound. Sensors: beta.ml_topic, regex.icontains, strings.icontains, strings.iends_with. Reference lists: $high_trust_sender_root_domains, $org_slds.

Indicators Matched (5)

Field	Match	Value
`beta.ml_topic(body.html.display_text).topics[].name`	equals	`File Sharing and Cloud Services`
`beta.ml_topic(body.html.display_text).topics[].confidence`	equals	`high`
`body.links[].href_url.domain.root_domain`	equals	`sharepoint.com`
`strings.iends_with`	suffix	`-my`
`regex.icontains`	regex	`\/:[obu]:\/(?:p\|g\/personal)`

Stages and Predicates

Stage 1: `mql_rule`

and
  or
    and
      not
        headers.auth_summary.dmarc.pass eq "true"
      sender.email.domain.root_domain macro "sender.email.domain.root_domain in high_trust_sender_root_domains"
    sender.email.domain.root_domain macro "sender.email.domain.root_domain not in high_trust_sender_root_domains"
  not
    sender.email.domain.root_domain in ["sharepoint.com", "sharepointonline.com"]
  body.html.display_text length_compare "2000"
  body.links length_compare "0"
  body.links length_compare "10"
  type.inbound eq "true"
   macro "any(beta.ml_topic(body.html.display_text).topics,\n        .name == \"File Sharing and Cloud Services\" and .confidence == \"high\"\n)"
   macro "any(filter(body.links, .href_url.domain.root_domain == 'sharepoint.com'),\n        // Normalize Levenshtein distance by string length (0 = identical, 0.7+ = different)\n        // Working with what we have in MQL, considering we dont have max() or any other forms of string distancing\n        (\n          (\n            strings.iends_with(.href_url.domain.subdomain,\n                               '-my'\n            ) // common Sharepoint subdomain suffix\n            and (\n              (\n                strings.ilevenshtein(.href_url.domain.subdomain,\n                                     sender.email.domain.sld\n                ) - 3 // subtract aforementioned suffix for more accurate calculation\n              ) / (\n                (\n                  (length(.href_url.domain.subdomain) - 3) + length(sender.email.domain.sld\n                  )\n + (\n                    (\n                      (length(.href_url.domain.subdomain) - 3) - length(sender.email.domain.sld\n                      )\n                    ) + (\n                      length(sender.email.domain.sld) - (\n                        length(.href_url.domain.subdomain) - 3\n                      )\n                    )\n                  )\n                ) / 2.0 // to ensure we keep the result as a float\n              )\n            ) > 0.7 // customizable threshold\n          )\n          or (\n            not strings.iends_with(.href_url.domain.subdomain,\n                                   '-my'\n            ) // no suffix, continue with original calculation\n            and (\n              strings.ilevenshtein(.href_url.domain.subdomain,\n                                   sender.email.domain.sld\n              ) / (\n                (\n                  length(.href_url.domain.subdomain) + length(sender.email.domain.sld\n                  )\n + (\n                    (\n                      length(.href_url.domain.subdomain) - length(sender.email.domain.sld\n                      )\n                    ) + (\n                      length(sender.email.domain.sld) - length(.href_url.domain.subdomain\n                      )\n                    )\n                  )\n                ) / 2.0 // to ensure we keep the result as a float\n              )\n            ) > 0.7 // customizable threshold\n          )\n        )\n        and not strings.icontains(.href_url.path, sender.email.local_part)\n        and not any($org_slds,\n                    strings.icontains(..href_url.domain.subdomain, .)\n        )\n\n        // it is either a OneNote or PDF file, or unknown\n        and regex.icontains(.href_url.path, '\\/:[obu]:\\/(?:p|g\\/personal)')\n)"
   macro "length(body.html.inner_text) < 6 * length(body.current_thread.text)"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean` corpus 1212 (mql 1212)	`field:"type.inbound" kind:eq value:"true"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`sender.email.domain.root_domain`	in	`sharepoint.com`, `sharepointonline.com`	`excludes:sender.email.domain.root_domain` `field:"sender.email.domain.root_domain" value:"sharepoint.com"` `field:"sender.email.domain.root_domain" value:"sharepointonline.com"`

Back to all Sublime MQL rules