detection.wiki

Detection rules › Sublime MQL

Sublime MQL rules: wordpress

RuleSeverity
Link: WordPress login page with Blogspot Binance scammedium
Suspected WordPress abuse with cross-site scripting (XSS) indicatorshigh

Link: WordPress login page with Blogspot Binance scam

#
Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing WordPress login links (/wp-login.php) combined with Blogspot domains and Binance cryptocurrency scam language patterns in the body text.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, BEC/Fraud
Tactics and techniquesSocial engineering, Free subdomain host, Impersonation: Brand

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • body
  • body.current_thread
  • body.links
  • type

Rule body

type.inbound
and any(body.links, .display_url.path == '/wp-login.php')
and regex.icontains(body.current_thread.text,
                    '[a-z]{5,10}\.blogspot\.[a-z.]{2,6}\s*-\s*\d[\d\s]*\s*(USD|EURO?)\s*BINANCE'
)

Detection logic

Scope: inbound message.

Detects messages containing WordPress login links (/wp-login.php) combined with Blogspot domains and Binance cryptocurrency scam language patterns in the body text.

  1. inbound message
  2. any of body.links where:
    • .display_url.path is '/wp-login.php'
  3. body.current_thread.text matches '[a-z]{5,10}\\.blogspot\\.[a-z.]{2,6}\\s*-\\s*\\d[\\d\\s]*\\s*(USD|EURO?)\\s*BINANCE'

Inspects: body.current_thread.text, body.links, body.links[].display_url.path, type.inbound. Sensors: regex.icontains.

Indicators matched (2)

FieldMatchValue
body.links[].display_url.pathequals/wp-login.php
regex.icontainsregex[a-z]{5,10}\.blogspot\.[a-z.]{2,6}\s*-\s*\d[\d\s]*\s*(USD|EURO?)\s*BINANCE

Stages and Predicates

Stage 1: mql_rule

and
  any(body.links)
    body.links.display_url.path eq "/wp-login.php"
  body.current_thread.text regex_match "[a-z]{5,10}\\.blogspot\\.[a-z.]{2,6}\\s*-\\s*\\d[\\d\\s]*\\s*(USD|EURO?)\\s*BINANCE"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
body.current_thread.textregex_match
  • [a-z]{5,10}.blogspot.[a-z.]{2,6}\s*-\s*\d[\d\s]*\s*(USD|EURO?)\s*BINANCE
field:"body.current_thread.text" kind:regex_match value:"[a-z]{5,10}.blogspot.[a-z.]{2,6}\s*-\s*\d[\d\s]*\s*(USD|EURO?)\s*BINANCE"
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"

Suspected WordPress abuse with cross-site scripting (XSS) indicators

#
Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages from likely compromised WordPress sites that exhibit indicators of cross-site scripting (XSS) attempts. The rule identifies potential script injection patterns within message bodies and/or subjects containing multiple suspicious JavaScript-related keywords or indicators.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware, Credential Phishing
Tactics and techniquesScripting, Impersonation: Brand, Social engineering

Telemetry coverage

PlatformRecord / event type
SublimeInbound email message

Message attributes

  • body
  • body.current_thread
  • sender.email
  • subject
  • type

Rule body

type.inbound
and sender.email.local_part == "wordpress"
and (
  regex.icontains(body.current_thread.text,
                  'document\.createElement.{0,9}script'
  )
  or 2 of (
    strings.icount(subject.subject, "script") > 1,
    strings.count(subject.subject, '%') >= 4,
    strings.count(subject.subject, '\') >= 3,
    strings.count(subject.subject, "/") >= 3,
    strings.icontains(subject.subject, "xss"),
    strings.contains(subject.subject, "CharCode"),
    strings.contains(subject.subject, 'onload'),
    strings.contains(subject.subject, 'fetch('),
    strings.contains(subject.subject, "OnFocus="),
    strings.contains(subject.subject, 'javascript:fetch'),
    strings.icontains(subject.subject, "src="),
    strings.icontains(subject.subject, "iframe"),
    strings.icontains(subject.subject, "embed"),
    strings.icontains(subject.subject, "object"),
    strings.icontains(subject.subject, "onerror"),
    strings.icontains(subject.subject, "onclick"),
    strings.icontains(subject.subject, "onmouseover"),
    strings.icontains(subject.subject, "onmouseout"),
    strings.icontains(subject.subject, "onkeydown"),
    strings.icontains(subject.subject, "onkeypress"),
    strings.icontains(subject.subject, "onkeyup"),
    strings.icontains(subject.subject, "onchange"),
    strings.icontains(subject.subject, "oninput"),
    strings.icontains(subject.subject, "onsubmit"),
    regex.icontains(subject.subject, 'eval\b'),
    strings.icontains(subject.subject, "alert"),
    strings.icontains(subject.subject, "document.cookie"),
    strings.icontains(subject.subject, "document.write"),
    strings.icontains(subject.subject, "window.location"),
    strings.icontains(subject.subject, "setTimeout"),
    strings.icontains(subject.subject, "setInterval"),
    strings.icontains(subject.subject, "atob"),
    strings.icontains(subject.subject, "innerHTML"),
    strings.icontains(subject.subject, "outerHTML"),
    strings.icontains(subject.subject, "XMLHttpRequest"),
    regex.icontains(subject.subject, 'import\b'),
    strings.icontains(subject.subject, "execCommand")
  )
)

Detection logic

Scope: inbound message.

Detects inbound messages from likely compromised WordPress sites that exhibit indicators of cross-site scripting (XSS) attempts. The rule identifies potential script injection patterns within message bodies and/or subjects containing multiple suspicious JavaScript-related keywords or indicators.

  1. inbound message
  2. sender.email.local_part is 'wordpress'
  3. any of:
    • body.current_thread.text matches 'document\\.createElement.{0,9}script'
    • at least 2 of:
      • strings.icount(subject.subject, 'script') > 1
      • strings.count(subject.subject, '%') ≥ 4
      • strings.count(subject.subject, '\\') ≥ 3
      • strings.count(subject.subject, '/') ≥ 3
      • subject.subject contains 'xss'
      • subject.subject contains 'CharCode'
      • subject.subject contains 'onload'
      • subject.subject contains 'fetch('
      • subject.subject contains 'OnFocus='
      • subject.subject contains 'javascript:fetch'
      • subject.subject contains 'src='
      • subject.subject contains 'iframe'
      • subject.subject contains 'embed'
      • subject.subject contains 'object'
      • subject.subject contains 'onerror'
      • subject.subject contains 'onclick'
      • subject.subject contains 'onmouseover'
      • subject.subject contains 'onmouseout'
      • subject.subject contains 'onkeydown'
      • subject.subject contains 'onkeypress'
      • subject.subject contains 'onkeyup'
      • subject.subject contains 'onchange'
      • subject.subject contains 'oninput'
      • subject.subject contains 'onsubmit'
      • subject.subject matches 'eval\\b'
      • subject.subject contains 'alert'
      • subject.subject contains 'document.cookie'
      • subject.subject contains 'document.write'
      • subject.subject contains 'window.location'
      • subject.subject contains 'setTimeout'
      • subject.subject contains 'setInterval'
      • subject.subject contains 'atob'
      • subject.subject contains 'innerHTML'
      • subject.subject contains 'outerHTML'
      • subject.subject contains 'XMLHttpRequest'
      • subject.subject matches 'import\\b'
      • subject.subject contains 'execCommand'

Inspects: body.current_thread.text, sender.email.local_part, subject.subject, type.inbound. Sensors: regex.icontains, strings.contains, strings.count, strings.icontains, strings.icount.

Indicators matched (35)

FieldMatchValue
sender.email.local_partequalswordpress
regex.icontainsregexdocument\.createElement.{0,9}script
strings.icontainssubstringxss
strings.containssubstringCharCode
strings.containssubstringonload
strings.containssubstringfetch(
strings.containssubstringOnFocus=
strings.containssubstringjavascript:fetch
strings.icontainssubstringsrc=
strings.icontainssubstringiframe
strings.icontainssubstringembed
strings.icontainssubstringobject
23 more
strings.icontainssubstringonerror
strings.icontainssubstringonclick
strings.icontainssubstringonmouseover
strings.icontainssubstringonmouseout
strings.icontainssubstringonkeydown
strings.icontainssubstringonkeypress
strings.icontainssubstringonkeyup
strings.icontainssubstringonchange
strings.icontainssubstringoninput
strings.icontainssubstringonsubmit
regex.icontainsregexeval\b
strings.icontainssubstringalert
strings.icontainssubstringdocument.cookie
strings.icontainssubstringdocument.write
strings.icontainssubstringwindow.location
strings.icontainssubstringsetTimeout
strings.icontainssubstringsetInterval
strings.icontainssubstringatob
strings.icontainssubstringinnerHTML
strings.icontainssubstringouterHTML
strings.icontainssubstringXMLHttpRequest
regex.icontainsregeximport\b
strings.icontainssubstringexecCommand

Stages and Predicates

Stage 1: mql_rule

and
  or
    body.current_thread.text regex_match "document\\.createElement.{0,9}script"
    strings.count func_call "strings.count(subject.subject, \"%\") >= 4"
    strings.count func_call "strings.count(subject.subject, \"/\") >= 3"
    strings.count func_call "strings.count(subject.subject, \"\\\") >= 3"
    strings.icount func_call "strings.icount(subject.subject, \"script\") > 1"
    subject.subject contains "CharCode"
    subject.subject contains "OnFocus="
    subject.subject contains "XMLHttpRequest"
    subject.subject contains "alert"
    subject.subject contains "atob"
    subject.subject contains "document.cookie"
    subject.subject contains "document.write"
    subject.subject contains "embed"
    subject.subject contains "execCommand"
    subject.subject contains "fetch("
    subject.subject contains "iframe"
    subject.subject contains "innerHTML"
    subject.subject contains "javascript:fetch"
    subject.subject contains "object"
    subject.subject contains "onchange"
    subject.subject contains "onclick"
    subject.subject contains "onerror"
    subject.subject contains "oninput"
    subject.subject contains "onkeydown"
    subject.subject contains "onkeypress"
    subject.subject contains "onkeyup"
    subject.subject contains "onload"
    subject.subject contains "onmouseout"
    subject.subject contains "onmouseover"
    subject.subject contains "onsubmit"
    subject.subject contains "outerHTML"
    subject.subject contains "setInterval"
    subject.subject contains "setTimeout"
    subject.subject contains "src="
    subject.subject contains "window.location"
    subject.subject contains "xss"
    subject.subject regex_match "eval\\b"
    subject.subject regex_match "import\\b"
  sender.email.local_part eq "wordpress"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
body.current_thread.textregex_match
  • document.createElement.{0,9}script
field:"body.current_thread.text" kind:regex_match value:"document.createElement.{0,9}script"
sender.email.local_parteq
  • wordpress
field:"sender.email.local_part" kind:eq value:"wordpress"
subject.subjectcontains
  • CharCode
  • OnFocus=
  • XMLHttpRequest
  • alert
  • atob
  • document.cookie
  • document.write
  • embed
  • execCommand
  • fetch(
  • iframe
  • innerHTML
  • javascript:fetch
  • object
  • onchange
  • onclick
  • onerror
  • oninput
  • onkeydown
  • onkeypress
  • onkeyup
  • onload
  • onmouseout
  • onmouseover
  • onsubmit
  • outerHTML
  • setInterval
  • setTimeout
  • src=
  • window.location
  • xss
field:"subject.subject" kind:contains
subject.subjectregex_match
  • eval\b
  • import\b
field:"subject.subject" kind:regex_match
type.inboundeq
  • true transforms: boolean
field:"type.inbound" kind:eq value:"true"