Sublime Security updates sublimesecurity.com

New

You can now view which mailbox users opened a message as well as when they opened it for messages ingested from Microsoft 365 or Google Workspace. You’ll see an open envelope icon in both the triage and investigation experiences, and you can hover over this icon for more details.

Soon, we’ll support opens on IMAP message sources and add API support. We’re also working on surfacing message replies and forwards!

Grab us on Slack or via email to support@sublimesecurity.com with any questions or feedback.

New

Recently we released a number of features designed to improve your Sublime experience:

• For users with the role admin or engineer, there’s now an option to automatically apply updates to installed feed rules. You can head to your Sublime Rules Feed page in the Dashboard to turn on the toggle!
• We’ve added 2 new default Lists to make rule writing easier: $file_extensions_common_archives and $file_extensions_macros. Rules in the Sublime Rules Feed have been updated to use these new Lists.
• We’ve improved the zip binexplode scanner, which now includes the file names within encrypted zips.

• LinkAnalysis now has improved detection of credential phishing pages via OCR, as well as better logic for identifying captchas and login input boxes.

• first_reported_at for user reports is now available in the list message groups API.

Grab us on Slack or via email with any support questions or feedback!

New

Today we’re introducing Rule severities - critical, high, medium, and low - to help you prioritize alerts during the triage and investigation process.

• critical is used to identify rules related to CVEs, malware families, and threat actors. critical alerts that were not auto-remediated should be reviewed immediately. critical can also be used for high-confidence, high-impact alerts that you want prioritized over everything else that is high.
• high alerts that were not auto-remediated should be reviewed quickly.
• medium alerts that were not auto-remediated should be reviewed frequently.
• low alerts that were not auto-remediated should be reviewed regularly.

You can think of severity as confidence-weighted impact, where confidence is how likely an alert is a true positive, and impact is the damage the attack the rule is designed to detect could cause.

Severities will now be visible in the dashboard anywhere you see a rule listed. As part of this release, we’ve set severities on all rules in the Sublime Rules Feed. For now, you can only add to or modify severities on any non-Feed rule. In the future, you’ll be able to set your own severities on Feed rules.

More information on Rule Severities is also available in our documentation.

How do I get started?

If you have an AWS deployment or Cloud account, you received this update automatically.

If you have a local Docker deployment, follow these instructions to update.

If you’re on the waitlist and want to get started with Sublime, please reply to this email and let us know. We’re currently onboarding folks as quickly as we can.

What's next?

Here are some of the other releases our team is actively working on:

• Detect HTML smuggling by analyzing files linked in the body of a message
• URL classifier for identifying suspicious links
• Easily manage exclusions to feed rules
• Flag messages that communicate “urgency”, “financial requests”, and more using Natural Language Understanding (NLU)
• Ingest and process historical messages in new Sublime deployments or newly added Message Sources

Grab us on Slack or via email with any support questions or feedback! You can also grab a feedback or catch-up session with us at any time here.

New

This release improves the way MQL functions are organized by grouping them into modules. Now, when you’re searching for MQL functions, you’ll find that your favorite string functions are grouped under strings. or regex.. In the future, we plan to add function modules for NLU, base64 parsing, HTTP requests, and more!

As part of this release, your custom rules are automatically migrated to the new function names, and the MQL editor will help you use the new names going forward. The old names will continue to work, but with a deprecation warning and a Quick Fix suggestion in the editor, so you can easily use the new names.

Rules in the Sublime Rules Feed have also been updated to use the new function names!

This release also includes a few new functions:

• strings.concat: Concatenate multiple strings on the fly.
• strings.contains: Check if one string contains another.
• strings.ends_with: Check if one string ends with another.
• strings.starts_with: Check if one string starts with another.

Unlike like, which uses a wildcard pattern that has to be known ahead of time, these new substring functions can flexibly support fields or other dynamic values for both arguments. For example, you can now do strings.icontains(subject.subject, mailbox.display_name).

The MQL editor is aware of this change, and will help you use the new names as you type.

When you use the old function names, the editor will suggest updates to automatically use the new name, and you can apply that update with a single click.

How do I get started?

If you have an AWS deployment or Cloud account, you received this update automatically.

If you have a local Docker deployment, follow these instructions to update.

If you’re on the waitlist and want to get started with Sublime, please reply to this email and let us know. We’re currently onboarding folks as quickly as we can.

What's next?

Here are some of the other releases our team is actively working on:

• Detect HTML smuggling by analyzing files linked in the body of a message
• URL classifier for identifying suspicious links
• Easily manage exclusions to feed rules
• Flag messages that communicate “urgency”, “financial requests”, and more using Natural Language Understanding (NLU)
• Use Rule severities to prioritize message triage and trigger distinct investigation workflows

Grab us on Slack or via email with any support questions or feedback! You can also grab a feedback or catch-up session with us at any time here.

New

We released a number of smaller updates this week to make it easier to investigate and remediate flagged and user reported messages.

You can now trigger Custom Actions manually as part of your investigation or remediation workflows. Previously you could only add Custom Actions to your Rules.

When triaging and investigating User Reported phish you’ll now see messages sorted by “First reported”.

We’ve added advanced filters to Hunt and Backtest results.

Lastly, you’ll now see a count of active mailboxes in Admin > Mailboxes and a breakdown by Message Source in Admin > Message Sources.

New

You can now auto-remediate phishing campaigns org-wide based on two or more user reports using a new MDM property: user_reports.count. Here’s a simple Triage Rule that can be set to auto-trash any campaigns with 2 or more user reports.

In this example, we see three users receiving the same phish. The first two report it, and as a result it’s auto-trashed from the inbox of the 3rd before they’ve seen it.

As with any Triage Rule, you can combine this with arbitrary MQL to auto-remediate campaigns based on any aspect of the message. Soon, we’ll add Feeds support for Triage Rules, so you can easily collaborate with others in the community on automatically handling user reports.

How do I get started?

If you have an AWS deployment or Cloud account, you received this update automatically.

If you have a local Docker deployment, follow these instructions to update.

If you’re on the waitlist and want to get started with Sublime, please reply to this email and let us know. We’re currently onboarding folks as quickly as we can.

What's next?

Here are some of the other releases our team is actively working on:

• Detect HTML smuggling by analyzing files linked in the body of a message
• URL classifier for identifying suspicious links
• Easily manage exclusions to feed rules
• Write detection rules that reference any number of arbitrary Azure AD or Google Groups
• Flag messages that communicate “urgency”, “financial requests”, and more using Natural Language Understanding (NLU)

Grab us on Slack or via email with any support questions or feedback! You can also grab a feedback or catch-up session with us at any time here.

New

Sublime can now identify credential phishing pages using the new linkanalysis function and ML-powered credphish scanner. Here’s a sample rule that will flag messages with a credential phishing link in the body:

The credphish scanner sends suspicious URLs to a headless browser which resolves the effective URL and collects a screenshot, which is then sent to an object detection model to detect brand logos, buttons, and input forms. Our model is based heavily on Phishpedia, an Open Source object detection project.

As part of this release we’re sharing 2 new detection rules via the Sublime Rules Feed:

• Credential phishing link (first-time sender)
• Free subdomain link with login or captcha (first-time sender)

Soon, you’ll be able to:

• Retrieve files downloaded via links and pass those files to binexplode
• Run linkanalysis on links retrieved from binexplode

View the LinkAnalysis documentation to learn more about this new function and how to use it. If you don’t already have an API key, email hello@sublimesecurity.com to request one.

How do I get started?

If you have an AWS deployment or Cloud account, you received this update automatically.

If you have a local Docker deployment, follow these instructions to update.

If you’re on the waitlist and want to get started with Sublime, please reply to this email and let us know. We’re currently onboarding folks as quickly as we can.

What's next?

Here are some of the other releases our team is actively working on:

• Detect HTML smuggling by analyzing files linked in the body of a message
• URL classifier for identifying suspicious links
• Easily manage exclusions to feed rules
• Write detection rules that reference any number of arbitrary Azure AD or Google Groups
• Flag messages that communicate “urgency”, “financial requests”, and more using Natural Language Understanding (NLU)

Grab us on Slack or via email with any support questions or feedback! You can also grab a feedback or catch-up session with us at any time here.

New

Today we’re releasing a key piece of our vision for Sublime: our first machine learning (ML) model available directly in MQL. beta.ml_macro_classifier analyzes documents for malicious VBA macros and can be combined with arbitrary detection logic, such as organizational context or other suspicious indicators, to build powerful new rules and hunting queries. 

With this release, it’s now possible to take advantage of the benefits of ML with the transparency and customizability of MQL. This is the first of many new models we’ll be releasing over the coming months. You can read more about this new function here.

Today we’re also sharing two new detection rules via the Sublime Rules Feed that leverage this function:

• Attachment: Suspicious VBA macros from first-time sender

• Attachment: Malicious VBA macros in Office document

  

We’re also sharing a new rule for threat discovery via Hunt:

• Attachment: Suspicious VBA macro (any confidence)

Soon you’ll be able to pass any files found via recursive binary explosion (using beta.binexplode) to this new beta.ml_macro_classifier function.

How do I get started?

If you have an AWS deployment or Cloud account, you received this update automatically.

If you have a local Docker deployment, follow these instructions to update.

If you’re on the waitlist and want to get started with Sublime, please reply to this email and let us know. We’re currently onboarding folks as quickly as we can.

What's next?

Here are some of the other releases our team is actively working on:

• Detect credential phishing by analyzing link destinations
• Write detection rules that reference any number of arbitrary Azure AD or Google Groups
• Detect HTML smuggling by analyzing files linked in the body of a message
• URL classifier for identifying suspicious links
• Easily manage exclusions to feed rules

Grab us on Slack or via email with any support questions or feedback! You can also grab a feedback or catch-up session with us at any time here.

New

You can now view completed and in-progress Hunts, and share Hunt results with your teammates. Hunts can be named, and you can quickly see who ran the Hunt and how many messages were found.

Soon, you’ll be able to view % remaining for in-progress Hunts and receive a notification when a Hunt completes.

As part of this release, we’ve brought the Analysis and “User View” sections of the investigation tool into the editor experience, so you’re always looking at the same context no matter where you’re viewing a message. You’ll also see these new tabs in the public playground!

How do I get started?

If you have an AWS deployment or Cloud account, you received this update automatically.

If you have a local Docker deployment, follow these instructions to update.

If you don't have early access to Sublime, you can request it here.

What's next?

Here are some of the other releases our team is actively working on:

• Detect credential phishing by analyzing link destinations
• Write detection rules that reference any number of arbitrary Azure AD or Google Groups
• Detect HTML smuggling by analyzing files linked in the body of a message
• URL classifier for identifying suspicious links
• Easily manage exclusions to feed rules

Grab us on Slack or via email with any support questions or feedback! You can also grab a feedback or catch-up session with us at any time here.

New

Sublime now supports Role-Based Access Control (RBAC), allowing you to assign roles with limited permissions to different Sublime users. We’ve added detailed new documentation breaking down the permissions of these three roles here.

Set user roles by visiting Admin > Account, selecting a user, then clicking “Edit” in the Actions menu. By default, all current dashboard users will remain Admins.

Soon, you’ll be able to create new roles with custom permissions!

How do I get started?

If you have an AWS deployment or Cloud account, you received this update automatically.

If you have a local Docker deployment, follow these instructions to update.

If you don't have early access to Sublime, you can request it here.

What's next?

Here are some of the other releases our team is actively working on:

• Run long-term Hunts, cancel running Hunts, and view prior Hunt results
• Detect credential phishing by analyzing link destinations
• Write detection rules that reference any number of arbitrary Azure AD or Google Groups
• Detect HTML smuggling by analyzing files linked in the body of a message
• URL classifier for identifying suspicious links

Grab us on Slack or via email with any support questions or feedback! You can also grab a feedback or catch-up session with us at any time here.