Detection rules › Sublime MQL
Attachment: CVE-2023-21716 - Microsoft Office Remote Code Execution Vulnerability
Attachment contains an RTF file with a font table defining an excessive number of fonts, used to exploit CVE-2023-21716.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Exploit |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ ("rtf", "doc", "docx")
or .file_extension in~ $file_extensions_common_archives
or .file_extension in~ $file_extensions_macros
or (
.file_extension is null
and .file_type == "unknown"
and .content_type == "application/octet-stream"
and .size < 100000000
)
)
and any(file.explode(.),
any(.scan.strings.strings, strings.ilike(., '*\fonttbl*'))
and length(filter(.scan.strings.strings,
strings.ilike(., '{\f*;}')
)
) > 10000
)
)
Detection logic
Scope: inbound message.
Attachment contains an RTF file with a font table defining an excessive number of fonts, used to exploit CVE-2023-21716.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in ('rtf', 'doc', 'docx')
- .file_extension in $file_extensions_common_archives
- .file_extension in $file_extensions_macros
all of:
- .file_extension is missing
- .file_type is 'unknown'
- .content_type is 'application/octet-stream'
- .size < 100000000
any of
file.explode(.)where all hold:any of
.scan.strings.stringswhere:- . matches '*\\fonttbl*'
- length(filter(.scan.strings.strings, strings.ilike(., '{\\f*;}'))) > 10000
Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, attachments[].size, type.inbound. Sensors: file.explode, strings.ilike. Reference lists: $file_extensions_common_archives, $file_extensions_macros.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | rtf |
attachments[].file_extension | member | doc |
attachments[].file_extension | member | docx |
attachments[].file_type | equals | unknown |
attachments[].content_type | equals | application/octet-stream |
strings.ilike | substring | *\fonttbl* |
strings.ilike | substring | {\f*;} |