Sublime Security high experimental mql

Attachment: Potential sandbox evasion in Office file

Scans attached files with known Office file extension, and alerts on the presence of strings indicative of sandbox evasion checks. Malicious code may carry out checks against the local host (e.g. running processes, disk size, domain-joined status) before running its final payload.

View Source

Detection Logic

type.inbound
and any(attachments,
        (
          .file_extension in~ $file_extensions_macros
          or (
            .file_extension is null
            and .file_type == "unknown"
            and .content_type == "application/octet-stream"
            and .size < 100000000
          )
        )
        and any(file.explode(.),
                1 of (
                  any(.scan.strings.strings,
                      strings.ilike(., "*Win32_Processor*")
                  ),
                  any(.scan.strings.strings,
                      strings.ilike(., "*Win32_LogicalDisk*")
                  ),
                  any(.scan.strings.strings,
                      strings.ilike(., "*Win32_ComputerSystem*")
                  ),
                  any(.scan.strings.strings,
                      strings.ilike(., "*Win32_Process*")
                  ),
                  any(.scan.strings.strings,
                      strings.ilike(., "*LDAP://RootDSE*")
                  )
                )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...