Sublime Security high experimental mql

Attachment: Microsoft SharePoint Impersonation via images in macro-enabled attachment

Detects macro-enabled Office documents (docx and similar extensions) that contain images with text mimicking Microsoft SharePoint file-sharing notifications. The embedded images reference SharePoint collaboration language such as invitations to edit or references to Microsoft 365 access controls, designed to deceive recipients into trusting the attachment.

View Source

Detection Logic

type.inbound
// office docx
and any(filter(attachments, .file_extension in $file_extensions_macros),
        any(file.explode(.),
            // that contain sharepoint file share email wording in images
            strings.icontains(.scan.ocr.raw,
                              ' invited you to edit',
                              'This invite will only work for you and people with existing access',
                              ' use of Microsoft 365 and may contain content that is controlled by'
            )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...