Sublime Security medium experimental mql

Attachment: ICS file with credential theft indicators

Detects inbound emails containing calendar invite (.ics) attachments where the parsed event description is classified by NLU as having high-confidence credential theft intent and financial communication topics, and where embedded links point to domains that differ from the sender's domain and match known free file hosts, free subdomain hosts, self-service creation platforms, URL shorteners, suspicious TLDs, or newly registered domains (less than 90 days old).

View Source

Detection Logic

type.inbound
and any(attachments,
        (
          .file_type == "ics"
          or .file_extension == "ics"
          or .content_type in ("application/ics", "text/calendar")
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and any(beta.file.parse_ics(.).events,
                any(ml.nlu_classifier(.description).intents,
                    .name == "cred_theft" and .confidence == "high"
                )
                and any(ml.nlu_classifier(.description).topics,
                        .name == "Financial Communications"
                        and .confidence != "low"
                )
                and any(.links,
                        .href_url.domain.root_domain != sender.email.domain.root_domain
                        and (
                          .href_url.domain.root_domain in $self_service_creation_platform_domains
                          or .href_url.domain.domain in $self_service_creation_platform_domains
                          or .href_url.domain.root_domain in $free_file_hosts
                          or .href_url.domain.domain in $free_file_hosts
                          or .href_url.domain.root_domain in $free_subdomain_hosts
                          or .href_url.domain.domain in $free_subdomain_hosts
                          or .href_url.domain.tld in $suspicious_tlds
                          or .href_url.domain.domain in $url_shorteners
                          or .href_url.domain.root_domain in $url_shorteners
                          or network.whois(.href_url.domain).days_old < 90
                        )
                )
        )
)
and not (
  strings.istarts_with(subject.base,
                       "accepted:",
                       "declined:",
                       "_accepted:",
                       "_declined:"
  )
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Field Validations

Loading…

Comments (0)

Loading comments...