detection.wiki

Detection rules › Sublime MQL

Attachment: Archive containing HTML file with file scheme link

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Attached archive contains an HTML file with a file:// link, likely pointing to an SMB server. This technique can be used to steal NTLM hashes of users who open the HTML file. Known technique of TA577.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Exploit, HTML smuggling, Social engineering

Event coverage

Message attribute
attachments (collection)
type

Rule body MQL

type.inbound
and any(attachments,
        .file_extension in $file_extensions_common_archives
        and any(file.explode(.),
                (
                  .file_extension in~ ("html", "htm", "shtml", "dhtml")
                  or .flavors.mime == "text/html"
                  or any(.flavors.yara, . == "html_file")
                )
                and any(.scan.url.urls, .scheme == "file")
        )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

Detection logic

Scope: inbound message.

Attached archive contains an HTML file with a file:// link, likely pointing to an SMB server. This technique can be used to steal NTLM hashes of users who open the HTML file. Known technique of TA577.

  1. inbound message
  2. any of attachments where all hold:
    • .file_extension in $file_extensions_common_archives
    • any of file.explode(.) where all hold:
      • any of:
        • .file_extension in ('html', 'htm', 'shtml', 'dhtml')
        • .flavors.mime is 'text/html'
        • any of .flavors.yara where:
          • . is 'html_file'
      • any of .scan.url.urls where:
        • .scheme is 'file'
  3. any of:
    • not:
      • profile.by_sender().solicited
    • all of:
      • profile.by_sender().any_messages_malicious_or_spam
      • not:
        • profile.by_sender().any_messages_benign

Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode, profile.by_sender. Reference lists: $file_extensions_common_archives.

Indicators matched (7)

FieldMatchValue
file.explode(attachments[])[].file_extensionmemberhtml
file.explode(attachments[])[].file_extensionmemberhtm
file.explode(attachments[])[].file_extensionmembershtml
file.explode(attachments[])[].file_extensionmemberdhtml
file.explode(attachments[])[].flavors.mimeequalstext/html
file.explode(attachments[])[].flavors.yara[]equalshtml_file
file.explode(attachments[])[].scan.url.urls[].schemeequalsfile