Sublime Security low experimental mql
Attachment: ICS with embedded document
ICS invite contains an embedded document.
Detection Logic
type.inbound
and any(attachments,
.file_extension == "ics"
and strings.ilike(file.parse_text(.).text,
'*ATTACH;ENCODING=*;VALUE=BINARY*'
)
and (
strings.ilike(file.parse_text(.).text, '*FILENAME=*.doc*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.dot*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.pp*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.wbk*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.xl*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.html*')
)
) Field Validations
Loading…
Comments (0)
Loading comments...