Sublime Security high experimental mql

Attachment: Archive containing HTML file with file scheme link

Attached archive contains an HTML file with a file:// link, likely pointing to an SMB server. This technique can be used to steal NTLM hashes of users who open the HTML file. Known technique of TA577.

View Source

Detection Logic

type.inbound
and any(attachments,
        .file_extension in $file_extensions_common_archives
        and any(file.explode(.),
                (
                  .file_extension in~ ("html", "htm", "shtml", "dhtml")
                  or .flavors.mime == "text/html"
                  or any(.flavors.yara, . == "html_file")
                )
                and any(.scan.url.urls, .scheme == "file")
        )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

Field Validations

Loading…

Comments (0)

Loading comments...