Detection rules › Sublime MQL
Attachment: 7z Archive Containing RAR File
Detects 7z archive attachments that contain RAR files, which may be used to evade detection by nesting compressed file formats.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ $file_extensions_common_archives
and .file_type == "7z"
)
and any(file.expand_archives(.).files, .file_type == "rar")
)
Detection logic
Scope: inbound message.
Detects 7z archive attachments that contain RAR files, which may be used to evade detection by nesting compressed file formats.
- inbound message
any of
attachmentswhere all hold:all of:
- .file_extension in $file_extensions_common_archives
- .file_type is '7z'
any of
file.expand_archives(.).fileswhere:- .file_type is 'rar'
Inspects: attachments[].file_extension, attachments[].file_type, type.inbound. Sensors: file.expand_archives. Reference lists: $file_extensions_common_archives.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | 7z |
file.expand_archives(attachments[]).files[].file_type | equals | rar |