Sublime Security high experimental mql

Attachment: .csproj with suspicious commands

Attached .csproj file contains suspicious commands.

View Source

Detection Logic

type.inbound
and any(attachments,
        .file_extension == "csproj"
        and any(file.explode(.),
                (
                  (any(.scan.strings.strings, strings.contains(., 'DllImport')))
                  and (
                    any(.scan.strings.strings,
                        strings.icontains(., 'CreateProcess')
                    )
                  )
                )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...