Sublime Security medium experimental mql

Attachment: 7z Archive Containing RAR File

Detects 7z archive attachments that contain RAR files, which may be used to evade detection by nesting compressed file formats.

View Source

Detection Logic

type.inbound
and any(attachments,
        (
          .file_extension in~ $file_extensions_common_archives
          and .file_type == "7z"
        )
        and any(file.expand_archives(.).files, .file_type == "rar")
)

Field Validations

Loading…

Comments (0)

Loading comments...