Sublime Security high experimental mql

Attachment: Excel file with suspicious template identifier

Detects Excel attachments containing a specific template identifier (TM16390866) in the EXIF metadata, which may indicate malicious or suspicious document templates being used to distribute harmful content.

View Source

Detection Logic

type.inbound
and any(attachments,
        .file_type == "xlsx"
        and any(beta.parse_exif(.).fields,
                .key == "Template" and .value == "TM16390866"
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...