Detection rules › Sublime MQL

Attachment: 7z Archive Containing RAR File

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects 7z archive attachments that contain RAR files, which may be used to evade detection by nesting compressed file formats.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware
Tactics and techniquesEvasion

Event coverage

Rule body MQL

type.inbound
and any(attachments,
        (
          .file_extension in~ $file_extensions_common_archives
          and .file_type == "7z"
        )
        and any(file.expand_archives(.).files, .file_type == "rar")
)

Detection logic

Scope: inbound message.

Detects 7z archive attachments that contain RAR files, which may be used to evade detection by nesting compressed file formats.

  1. inbound message
  2. any of attachments where all hold:
    • all of:
      • .file_extension in $file_extensions_common_archives
      • .file_type is '7z'
    • any of file.expand_archives(.).files where:
      • .file_type is 'rar'

Inspects: attachments[].file_extension, attachments[].file_type, type.inbound. Sensors: file.expand_archives. Reference lists: $file_extensions_common_archives.

Indicators matched (2)

FieldMatchValue
attachments[].file_typeequals7z
file.expand_archives(attachments[]).files[].file_typeequalsrar