detection.wiki

Detection rules › Sublime MQL

Zoom Events newsletter abuse

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects suspicious content in Zoom Events notifications that contain credential theft language and links to file hosting sites.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesFree file host, Free subdomain host, Social engineering, Impersonation: Brand

Event coverage

Message attribute
body
headers.auth_summary
sender.email
type

Rule body MQL

type.inbound
and sender.email.email == "noreply-zoomevents@zoom.us"
and (headers.auth_summary.spf.pass or headers.auth_summary.dmarc.pass)

// extract the actor controlled message from the email body
and any(html.xpath(body.html,
                   "//div[@class='eb-content css-1l7xmti']//td[@data-dynamic-style-background-color='email.bodyColor.color' and @style='border-radius: 8px; background-color: rgb(255, 255, 255);']"
        ).nodes,
        // look at the content before the copyright footer in the template and pass it to NLU to see if it's cred theft 
        any(html.xpath(.,
                       "//td[@data-dynamic-style-background-color='email.bodyColor.color']/*[position() < last()]"
            ).nodes,
            any(ml.nlu_classifier(..display_text).intents,
                .name == "cred_theft" and .confidence != "low"
            )
        )
)

Detection logic

Scope: inbound message.

Detects suspicious content in Zoom Events notifications that contain credential theft language and links to file hosting sites.

  1. inbound message
  2. sender.email.email is 'noreply-zoomevents@zoom.us'
  3. any of:
    • headers.auth_summary.spf.pass
    • headers.auth_summary.dmarc.pass
  4. any of html.xpath(body.html, "//div[@class='eb-content css-1l7xmti']//td[@data-dynamic-style-background-color='email.bodyColor.color' and @style='border-radius: 8px; background-color: rgb(255, 255, 255);']").nodes where:
    • any of html.xpath(., "//td[@data-dynamic-style-background-color='email.bodyColor.color']/*[position() < last()]").nodes where:
      • any of ml.nlu_classifier(.display_text).intents where all hold:
        • .name is 'cred_theft'
        • .confidence is not 'low'

Inspects: body.html, headers.auth_summary.dmarc.pass, headers.auth_summary.spf.pass, sender.email.email, type.inbound. Sensors: html.xpath, ml.nlu_classifier.

Indicators matched (2)

FieldMatchValue
sender.email.emailequalsnoreply-zoomevents@zoom.us
ml.nlu_classifier(html.xpath(body.html, "//div[@class='eb-content css-1l7xmti']//td[@data-dynamic-style-background-color='email.bodyColor.color' and @style='border-radius: 8px; background-color: rgb(255, 255, 255);']").nodes[].display_text).intents[].nameequalscred_theft