Detection rules › Sublime MQL

Sublime MQL rules: uri

Rule	Severity
URI protocol handler: search-ms	`high`

URI protocol handler: search-ms

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects HTML attachments using the search-ms URI protocol handler, a technique observed ITW to deliver malicious payloads. This rule can be updated to analyze links in PDF attachments and message bodies

Threat Classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Malware/Ransomware
Tactics and techniques	Evasion

Telemetry Coverage

Platform	Record / event type
Sublime	Inbound email message

Message Attributes

attachments
type

Rule Body

type.inbound
and any(attachments,
        .file_type == "html"
        and any(file.explode(.),
                any(.scan.strings.strings,
                    regex.contains(., 'search-ms:query.*location:\\\\')
                )
        )
)

Detection Logic

Scope: inbound message.

inbound message
any of attachments where all hold:
- .file_type is 'html'
- any(file.explode(.), any(.scan.strings.strings, regex.contains(., 'search-ms:query.*location:\\\\') ) )

Inspects: attachments[].file_type, type.inbound. Sensors: file.explode, regex.contains.

Indicators Matched (2)

Field	Match	Value
`attachments[].file_type`	equals	`html`
`regex.contains`	regex	`search-ms:query.*location:\\\\`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(attachments)
    and
      attachments.file_type eq "html"
       macro "any(file.explode(.),\n                any(.scan.strings.strings,\n                    regex.contains(., 'search-ms:query.*location:\\\\\\\\')\n                )\n        )"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean` corpus 1212 (mql 1212)	`field:"type.inbound" kind:eq value:"true"`

Back to all Sublime MQL rules