Sublime Security high experimental mql

Attachment: OLE external relationship containing file scheme link to executable filetype

This rule identifies attachments containing file scheme links pointing to executable file types, a common indicator of malware distribution. It applies to various suspicious file extensions and archive formats, aiming to prevent the initiation and execution of malicious software.

View Source

Detection Logic

type.inbound
and any(attachments,
        (
          .file_extension in~ $file_extensions_macros
          or .file_extension in~ $file_extensions_common_archives
          or (
            .file_extension is null
            and .file_type == "unknown"
            and .content_type == "application/octet-stream"
            and .size < 100000000
          )
        )
        and length(file.oletools(.).relationships) < 500
        and any(file.oletools(.).relationships,
                .target_url.scheme == "file"
                and regex.icontains(.target_url.path,
                                    '\.(action
| ahk
| apk
| app
| appimage
| applescript
| bat
| bin
| cab
| cmd
| command
| cpl
| dll
| dmg
| exe
| gadget
| hta
| inf
| ins
| ipa
| isu
| jar
| job
| js
| jse
| lnk
| msi
| msp
| paf
| pif
| ps1
| rgs
| run
| scr
| sct
| sh
| shb
| vb
| vbe
| vbs)($
| [^\w])'
                )
                // avoid flagging on internal/network drives mappings
                and not (
                  strings.starts_with(.target_url.scheme, "file")
                  and not regex.imatch(.target_url.path, '/?[a-z]:/')
                )
        )
)
and (
  not profile.by_sender().any_messages_benign
  or profile.by_sender().any_messages_malicious_or_spam
)

Field Validations

Loading…

Comments (0)

Loading comments...