Sublime Security medium experimental mql

Attachment: Macro files containing MHT content

Detects macro-enabled files that contain embedded MHT (MIME HTML) content, which is commonly used to hide malicious code through file format manipulation.

View Source

Detection Logic

type.inbound
and any(attachments,
        .file_extension in $file_extensions_macros
        and any(file.explode(.),
                .file_extension == "mht"
                and not .flavors.mime == "message/rfc822"
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...