Detection rules › Sublime MQL

Attachment: Base64 encoded bash command in filename

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule detects a fileless attack technique where a malicious payload is encoded directly into a filename. This technique is used by threats like VShell. The rule is designed to find these malicious filenames both in direct attachments and within archived files (like .zip, .rar, etc.).

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware
Tactics and techniquesEncryption, Evasion

Event coverage

Rule body MQL

type.inbound
and length(attachments) > 0
and any(attachments,
        (
          .file_type in $file_extensions_common_archives
          or strings.contains(.file_name, "{")
        )
        and any(file.expand_archives(.).files,
                strings.contains(.file_name, "{")
                and (
                  strings.icontains(.file_name, 'echo,')
                  or strings.icontains(.file_name, 'base64')
                  or regex.icontains(.file_name, '\bbash\b')
                  or any(beta.scan_base64(.file_name, ignore_padding=true),
                         length(.) >= 10
                  )
                )
        )
)

Detection logic

Scope: inbound message.

This rule detects a fileless attack technique where a malicious payload is encoded directly into a filename. This technique is used by threats like VShell. The rule is designed to find these malicious filenames both in direct attachments and within archived files (like .zip, .rar, etc.).

  1. inbound message
  2. length(attachments) > 0
  3. any of attachments where all hold:
    • any of:
      • .file_type in $file_extensions_common_archives
      • .file_name contains '{'
    • any of file.expand_archives(.).files where all hold:
      • .file_name contains '{'
      • any of:
        • .file_name contains 'echo,'
        • .file_name contains 'base64'
        • .file_name matches '\\bbash\\b'
        • any of beta.scan_base64(.file_name) where:
          • length(.) ≥ 10

Inspects: attachments[].file_name, attachments[].file_type, type.inbound. Sensors: beta.scan_base64, file.expand_archives, regex.icontains, strings.contains, strings.icontains. Reference lists: $file_extensions_common_archives.

Indicators matched (4)

FieldMatchValue
strings.containssubstring{
strings.icontainssubstringecho,
strings.icontainssubstringbase64
regex.icontainsregex\bbash\b