Sublime Security high experimental mql

Attachment: PowerShell content

Recursively scans files and archives to detect PowerShell content. While scripts are often blocked by mail filtering, alternative file formats and archived content may be employed to bypass such controls.

View Source

Detection Logic

type.inbound
and any(attachments,
        (
          .file_extension in~ (
            // PowerShell related file extensions
            "ps1",
            "ps1xml",
            "psm1",
            "psd1",
            "pssc",
            "psrc",
            "cdxml",
            "ps2",
            "ps2xml",
            "psc2",
          )
          or .file_extension in~ $file_extensions_common_archives
        )
        and any(file.explode(.),
                .file_extension in~ (
                  "ps1",
                  "ps1xml",
                  "psm1",
                  "psd1",
                  "pssc",
                  "psrc",
                  "cdxml",
                  "ps2",
                  "ps2xml",
                  "psc2",
                )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...