Detection rules › Sublime MQL

Sublime MQL rules: uri

Rule	Severity
URI protocol handler: search-ms	`high`

URI protocol handler: search-ms

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects HTML attachments using the search-ms URI protocol handler, a technique observed ITW to deliver malicious payloads. This rule can be updated to analyze links in PDF attachments and message bodies

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Malware/Ransomware
Tactics and techniques	Evasion

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

attachments
type

Rule body

type.inbound
and any(attachments,
        .file_type == "html"
        and any(file.explode(.),
                any(.scan.strings.strings,
                    regex.contains(., 'search-ms:query.*location:\\\\')
                )
        )
)

Detection logic

Scope: inbound message.

inbound message
any of attachments where all hold:
- .file_type is 'html'
- any of file.explode(.) where:
  - any of .scan.strings.strings where:
    
    . matches 'search-ms:query.*location:\\\\\\\\'

Inspects: attachments[].file_type, type.inbound. Sensors: file.explode, regex.contains.

Indicators matched (2)

Field	Match	Value
`attachments[].file_type`	equals	`html`
`regex.contains`	regex	`search-ms:query.*location:\\\\`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(attachments)
    and
      any(file.explode(attachments))
        any(file.explode(attachments).scan.strings.strings)
          file.explode(attachments).scan.strings.strings regex_match "search-ms:query.*location:\\\\\\\\"
      attachments.file_type eq "html"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`