Sublime Security medium experimental mql

Link: Microsoft protected message with suspicious recipient patterns

Detects when a user receives a protected message (RPMSG) with the to and from headers matching or there is no TO header at all. Benign matches are possible, sender exclusions can be used to avoid matching on senders which commonly use Microsoft protected messages with suspicious recipient patterns

View Source

Detection Logic

type.inbound
// contains the rpmsg
and any(attachments,
        .file_extension == "rpmsg"
        or .content_type == "application/x-microsoft-rpmsg-message"
)
// contains the proper link
and any(body.links,
        .href_url.domain.root_domain == "office365.com"
        and (
          strings.icontains(.href_url.query_params, "InternetMessageID=")
          or strings.icontains(.href_url.path, '/Encryption/retrieve.ashx')
        )
)
and (
  // self sender 
  (
    length(recipients.to) == 1
    and recipients.to[0].email.email == sender.email.email
  )
  // no recipients at all
  or length(recipients.to) == 0
)

False Positives

⚠ Some senders commonly send messages which match this behavior, sender exclusions should be used to avoid continued/repeat matching of benign messages

Field Validations

Loading…

Comments (0)

Loading comments...