Detection rules › Sublime MQL
Attachment: cmd file extension
Detects messages containing CMD (Command Prompt) batch files, either as direct attachments or within compressed archives. CMD files can execute arbitrary system commands and are commonly used to deliver malware or perform unauthorized system modifications.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and length(attachments) > 0
and any(attachments,
.file_extension =~ "cmd"
or (
.file_extension in~ $file_extensions_common_archives
and any(file.explode(.), .file_extension =~ "cmd")
)
)
Detection logic
Scope: inbound message.
Detects messages containing CMD (Command Prompt) batch files, either as direct attachments or within compressed archives. CMD files can execute arbitrary system commands and are commonly used to deliver malware or perform unauthorized system modifications.
- inbound message
- length(attachments) > 0
any of
attachmentswhere any holds:- .file_extension is 'cmd'
all of:
- .file_extension in $file_extensions_common_archives
any of
file.explode(.)where:- .file_extension is 'cmd'
Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode. Reference lists: $file_extensions_common_archives.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | equals | cmd |
file.explode(attachments[])[].file_extension | equals | cmd |