Sublime Security high experimental mql

Attachment: Malformed OLE file

Attached OLE file (typically a Microsoft Office document) is malformed, possibly to evade traditional scanners and filters.

View Source

Detection Logic

type.inbound
and any(attachments,
        .file_extension in $file_extensions_macros
        and any(file.explode(.),
                any(.scan.yara.matches, .name == "MALFORMED_OLE_HEADER")
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...