Detection rules › Sublime MQL

Attachment: Archive with embedded EXE file

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Recursively scans files and archives to detect embedded EXE files (with an MZ header). According to The Record, on June 7, 2021, the Ukrainian Secret Service attributed an attack that used this technique to the "special services of the Russian Federation". The spear-phishing operation urged recipients to download a RAR archive included in the email, which, when decompressed, would drop an EXE file with a double extension (filename.pdf.exe) that tried to pass as a PDF file.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware
Tactics and techniquesEvasion

Event coverage

Rule body MQL

type.inbound
and any(attachments,
        (
          .file_extension in~ $file_extensions_common_archives
          or .file_type == "rar"
        )
        and any(file.explode(.),
                // the YARA scanner alone can be a bit unreliable,
                // it's matched on MZ strings in a text file before
                any(.flavors.yara, . == "mz_file")
                and strings.starts_with(.flavors.mime, "application")
        )
)

Detection logic

Scope: inbound message.

Recursively scans files and archives to detect embedded EXE files (with an MZ header). According to The Record, on June 7, 2021, the Ukrainian Secret Service attributed an attack that used this technique to the "special services of the Russian Federation". The spear-phishing operation urged recipients to download a RAR archive included in the email, which, when decompressed, would drop an EXE file with a double extension (filename.pdf.exe) that tried to pass as a PDF file.

  1. inbound message
  2. any of attachments where all hold:
    • any of:
      • .file_extension in $file_extensions_common_archives
      • .file_type is 'rar'
    • any of file.explode(.) where all hold:
      • any of .flavors.yara where:
        • . is 'mz_file'
      • .flavors.mime starts with 'application'

Inspects: attachments[].file_extension, attachments[].file_type, type.inbound. Sensors: file.explode, strings.starts_with. Reference lists: $file_extensions_common_archives.

Indicators matched (3)

FieldMatchValue
attachments[].file_typeequalsrar
file.explode(attachments[])[].flavors.yara[]equalsmz_file
strings.starts_withprefixapplication