Detection rules › Sublime MQL
Attachment: Base64 encoded bash command in filename
This rule detects a fileless attack technique where a malicious payload is encoded directly into a filename. This technique is used by threats like VShell. The rule is designed to find these malicious filenames both in direct attachments and within archived files (like .zip, .rar, etc.).
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Encryption, Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and length(attachments) > 0
and any(attachments,
(
.file_type in $file_extensions_common_archives
or strings.contains(.file_name, "{")
)
and any(file.expand_archives(.).files,
strings.contains(.file_name, "{")
and (
strings.icontains(.file_name, 'echo,')
or strings.icontains(.file_name, 'base64')
or regex.icontains(.file_name, '\bbash\b')
or any(beta.scan_base64(.file_name, ignore_padding=true),
length(.) >= 10
)
)
)
)
Detection logic
Scope: inbound message.
This rule detects a fileless attack technique where a malicious payload is encoded directly into a filename. This technique is used by threats like VShell. The rule is designed to find these malicious filenames both in direct attachments and within archived files (like .zip, .rar, etc.).
- inbound message
- length(attachments) > 0
any of
attachmentswhere all hold:any of:
- .file_type in $file_extensions_common_archives
- .file_name contains '{'
any of
file.expand_archives(.).fileswhere all hold:- .file_name contains '{'
any of:
- .file_name contains 'echo,'
- .file_name contains 'base64'
- .file_name matches '\\bbash\\b'
any of
beta.scan_base64(.file_name)where:- length(.) ≥ 10
Inspects: attachments[].file_name, attachments[].file_type, type.inbound. Sensors: beta.scan_base64, file.expand_archives, regex.icontains, strings.contains, strings.icontains. Reference lists: $file_extensions_common_archives.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
strings.contains | substring | { |
strings.icontains | substring | echo, |
strings.icontains | substring | base64 |
regex.icontains | regex | \bbash\b |