detection.wiki

Detection rules › Sublime MQL

Attachment: Zip exploiting CVE-2023-38831 (unsolicited)

Severity
critical
Type
rule
Source
github.com/sublime-security/sublime-rules

A Zip attachment that exhibits attributes required to exploit CVE-2023-38831, a vulnerability in WinRAR (prior to 6.23).

Event coverage

Message attribute
attachments (collection)
sender.email
type

Rule body MQL

type.inbound
and any(attachments,
    .file_extension in $file_extensions_common_archives and
    any(file.explode(.), 
        (
            .depth == 0 and 
            any(.scan.zip.all_paths, 
                regex.match(., 
                // zip contains a path with spaces and file extensions 
                // lure.pdf /lure.pdf .cmd
                // 
                //  /= Initial file name (including any spaces)
                //  |
                //  |       /= Space
                //  |       |
                //  |       | /= Folder
                //  |       | |
                //  |       | | /= Repeated file name
                //  |       | | |
                //  |       | | |      /= Space
                //  |       | | |      |   
                //  |       | | |      |   /= Real script ending
                //  |       | | |      |   |
                    '.+\.\w+\s\/.+\.\w+\s\.\w+'
                )
            )
        ) and 
        (
            // One file name is present in another, e.g.
            //     delivrto.pdf 
            //     delivrto.pdf /delivrto.pdf .cmd
            any(.scan.zip.all_paths, 
                any(..scan.zip.all_paths,
                    . != .. and 
                    strings.starts_with(., ..)
                )
            )
        )
    )
)
and (
    (
        sender.email.domain.root_domain in $free_email_providers
        and sender.email.email not in $recipient_emails
    )
    or (
        sender.email.domain.root_domain not in $free_email_providers
        and sender.email.domain.domain not in $recipient_domains
    )
)

Detection logic

Scope: inbound message.

A Zip attachment that exhibits attributes required to exploit CVE-2023-38831, a vulnerability in WinRAR (prior to 6.23).

  1. inbound message
  2. any of attachments where all hold:
    • .file_extension in $file_extensions_common_archives
    • any of file.explode(.) where all hold:
      • all of:
        • .depth is 0
        • any of .scan.zip.all_paths where:
          • . matches '.+\\.\\w+\\s\\/.+\\.\\w+\\s\\.\\w+'
      • any of .scan.zip.all_paths where:
        • any of .scan.zip.all_paths where all hold:
          • . is not .
          • strings.starts_with(.)
  3. any of:
    • all of:
      • sender.email.domain.root_domain in $free_email_providers
      • sender.email.email not in $recipient_emails
    • all of:
      • sender.email.domain.root_domain not in $free_email_providers
      • sender.email.domain.domain not in $recipient_domains

Inspects: attachments[].file_extension, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.email, type.inbound. Sensors: file.explode, regex.match, strings.starts_with. Reference lists: $file_extensions_common_archives, $free_email_providers, $recipient_domains, $recipient_emails.

Indicators matched (1)

FieldMatchValue
regex.matchregex.+\.\w+\s\/.+\.\w+\s\.\w+