Sublime Security medium experimental mql

Link: Google Forms link with credential theft language

Detects messages containing Google Forms links paired with credential theft language from new senders. This technique abuses Google's trusted domain to host malicious forms designed to steal user credentials.

View Source

Detection Logic

type.inbound
// cred_theft intent
and any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence != "low"
)
// google form link
and any(body.current_thread.links,
        (
          .href_url.domain.domain == "docs.google.com"
          and strings.istarts_with(.href_url.path, '/form')
        )
        or .href_url.domain.root_domain == "forms.gle"
)
// new sender
and profile.by_sender_email().prevalence == "new"

Field Validations

Loading…

Comments (0)

Loading comments...