Detection rules › Sublime MQL
Attachment: Any HTML file within archive (unsolicited)
Recursively scans archives to detect HTML files from unsolicited senders. HTML files can be used for HTML smuggling and embedded in archives to evade detection.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion, HTML smuggling |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
.file_extension in~ $file_extensions_common_archives
and any(file.explode(.),
.depth > 0 and .file_extension in~ ("html", "htm")
)
)
and (
not profile.by_sender().solicited
or (profile.by_sender().any_messages_malicious_or_spam)
)
and not profile.by_sender().any_messages_benign
Detection logic
Scope: inbound message.
Recursively scans archives to detect HTML files from unsolicited senders. HTML files can be used for HTML smuggling and embedded in archives to evade detection.
- inbound message
any of
attachmentswhere all hold:- .file_extension in $file_extensions_common_archives
any of
file.explode(.)where all hold:- .depth > 0
- .file_extension in ('html', 'htm')
any of:
not:
- profile.by_sender().solicited
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode, profile.by_sender. Reference lists: $file_extensions_common_archives.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
file.explode(attachments[])[].file_extension | member | html |
file.explode(attachments[])[].file_extension | member | htm |