Sublime Security medium experimental mql

Attachment with unscannable encrypted zip

Recursively scans files and archives to detect embedded ZIP files that are encrypted and could not be opened/scanned.

View Source

Detection Logic

type.inbound
and any(attachments,
        (.file_type == "zip" or .file_extension == "zip")
        and any(file.explode(.),
                any(.flavors.yara, . == 'encrypted_zip')
                and .scan.encrypted_zip.cracked_password == null
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...