MQL for Email APT Hunting | Bryan Campbell
Presenters detail vulnerability discovery and exploitation in MQL for Email APT Hunting | Bryan Campbell.
Summary
Platform overview
Brian Campbell of Sublime explains MQL (Message Query Language) for email threat hunting, supported by Autonomous Security Analyst and Autonomous Detection Engineer components for adaptive defense.
MQL and enrichments
MQL expresses attacker TTPs with organizational context, NLU, computer vision, OCR, link rendering, WHOIS, ML scoring, and deep attachment analysis via File Explode/Strelka across nested archives, macros, HTML smuggling, and encrypted zips.
Risk scoring
Multiple weak signals are weighted into one interpretable severity score to reduce false positives and catch sophisticated campaigns that evade single-indicator rules.
APT29 example
He details Russian espionage email tradecraft—thread hijacking, secure-document lures, OAuth consent abuse, and inbox-rule forwarding—and walks through a diplomatic spearphish using HTML smuggling to drop IMG/ISO/LNK/DLL chains designed to bypass attachment-only controls, with MQL focused on detecting the HTML dropper.
Related talks
Black Hat·58 min
Fyodor Yarochkin · Tsung Pei Kan · Ming-Chang Chiu · Ming-Wei Benson Wu
Analysts investigate attack surfaces and defenses concerning USA 2013 - Hunting the Shadows: In Depth Analysis of Escalated APT Attacks.
RSAC Cybersecurity·47 min
Analysts investigate attack surfaces and defenses concerning Nation-State Espionage: Hunting Multi-Platform APTs on a Global Scale.
BSidesAugusta·50 min
Beer Money
Engineers explore architecture and security mechanisms for 2018 - Paul Melson - Hunting APTs and Script Kiddies with Beer Money.