Sublime Security medium experimental mql

Attachment: DOCX with hyperlink targeting recipient address

Detects DOCX attachments containing hyperlinks with anchor references that match recipient email addresses. This technique is commonly used to personalize malicious documents and evade detection.

View Source

Detection Logic

type.inbound
and any(filter(attachments, .file_extension in ('docx', 'docm')),
        any(filter(file.explode(.),
                   strings.icontains(.scan.strings.raw, '<w:hyperlink')
            ),
            any(regex.iextract(.scan.strings.raw,
                               '<w:hyperlink[^\>]*w:anchor="(?P<email_address>[^\"]+)"'
                ),
                .named_groups["email_address"] == recipients.to[0].email.email
                or any(strings.scan_base64(.named_groups["email_address"],
                                           ignore_padding=true
                       ),
                       strings.icontains(., recipients.to[0].email.email)
                )
            )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...