Sublime Security high experimental mql

Attachment: Word document with hyperlink and fraud language

Detects inbound messages sent from free email providers with an empty subject line and body that carry a Word document (doc/docx) attachment. The attachment is inspected for embedded HYPERLINK field codes containing valid URLs, and its extracted text is passed through an NLU classifier to identify credential theft or advance fee fraud intent, indicating a socially engineered attack hidden inside the document.

View Source

Detection Logic

type.inbound
and sender.email.domain.root_domain in $free_email_providers
and not (subject.is_reply or subject.is_forward)
and subject.base == ''
and body.current_thread.text == ''
and any(filter(attachments, .file_type in~ ("docx", "doc")),
        any(file.explode(.),
            any(html.xpath(strings.parse_html(.scan.strings.raw),
                           "//*[contains(text(),'HYPERLINK')]"
                ).nodes,
                any(regex.extract(.raw, 'https?://[^"''<>&\s]+'),
                    strings.parse_url(.full_match).domain.valid
                )
            )
        )
        and any(file.explode(.),
                .file_name == "text"
                and any(ml.nlu_classifier(.scan.strings.raw).intents,
                        .name in ("cred_theft", "advance_fee")
                        and .confidence != 'low'
                )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...