Sublime Security unknown experimental mql

Attachment: Suspicious VBA macro

Detects any VBA macro attachment that scores above a low confidence threshold in the Sublime Macro Classifier.

View Source

Detection Logic

type.inbound
and any(attachments,
        .file_extension in~ (
          "doc",
          "docm",
          "docx",
          "dot",
          "dotm",
          "pptm",
          "ppsm",
          "xlm",
          "xls",
          "xlsb",
          "xlsm",
          "xlt",
          "xltm"
        )

        and ml.macro_classifier(.).malicious
        and ml.macro_classifier(.).confidence in ("low", "medium", "high")
)

Field Validations

Loading…

Comments (0)

Loading comments...