High Severity
Link: QR code in EML attachment with credential phishing indicators
Description
This rule detects QR codes in EML attachments that return a phishing disposition when analyzed, or are leveraging a known open redirect.
References
No references.
Sublime Security
Created Feb 7th, 2024 • Last updated Apr 25th, 2024
Feed Source
Sublime Core Feed
Source
type.inbound
and length(attachments) == 1
and any(attachments,
(.content_type == "message/rfc822" or .file_extension =~ "eml")
// credential theft language in the attached EML
and any(file.explode(.),
.depth > 0
and .scan.qr.type == "url"
// linkanalysis phishing disposition
and any([ml.link_analysis(.scan.qr.url)],
.credphish.disposition == "phishing"
or any(..scan.qr.url.rewrite.encoders,
strings.icontains(., "open_redirect")
)
)
and .scan.qr.url.domain.root_domain not in $org_domains
)
)
Playground
Test against your own EMLs or sample data.