• Sublime Core Feed
Medium Severity

Attachment: EML file with IPFS links

Labels

Credential Phishing
Evasion
Free file host
Free subdomain host
IPFS
File analysis
URL analysis

Description

Attached EML uses engaging language and IPFS links were detected in the EML file. IPFS has been recently observed hosting phishing sites.

References

Sublime Security
Created Aug 17th, 2023 • Last updated Apr 25th, 2024
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(attachments,
        .content_type == "message/rfc822"
        and any(file.explode(.),
                any(.scan.url.urls,
                    strings.icontains(ml.link_analysis(.).effective_url.url,
                                      'ipfs'
                    )
                    or (
                      regex.icontains(ml.link_analysis(.).effective_url.path,
                                      '[\.-/]ipfs|ipfs[\.-/]'
                      )
                      and ml.link_analysis(.).effective_url.domain.domain not in $org_domains
                      and (
                        (
                          // don't include high rep domains
                          ml.link_analysis(.).effective_url.domain.domain not in $tranco_1m
                          and ml.link_analysis(.).effective_url.domain.domain not in $umbrella_1m
                        )
                        // if it's in Tranco or Umbrella, still include it if it's one of these
                        or ml.link_analysis(.).effective_url.domain.domain in $free_file_hosts
                        or ml.link_analysis(.).effective_url.domain.root_domain in $free_file_hosts
                        or ml.link_analysis(.).effective_url.domain.root_domain in $free_subdomain_hosts
                      )
                    )
                )
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started