Detection rules › Sublime MQL
Attachment: DOCX with hyperlink targeting recipient address
Detects DOCX attachments containing hyperlinks with anchor references that match recipient email addresses. This technique is commonly used to personalize malicious documents and evade detection.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(attachments, .file_extension in ('docx', 'docm')),
any(filter(file.explode(.),
strings.icontains(.scan.strings.raw, '<w:hyperlink')
),
any(regex.iextract(.scan.strings.raw,
'<w:hyperlink[^\>]*w:anchor="(?P<email_address>[^\"]+)"'
),
.named_groups["email_address"] == recipients.to[0].email.email
or any(strings.scan_base64(.named_groups["email_address"],
ignore_padding=true
),
strings.icontains(., recipients.to[0].email.email)
)
)
)
)
Detection logic
Scope: inbound message.
Detects DOCX attachments containing hyperlinks with anchor references that match recipient email addresses. This technique is commonly used to personalize malicious documents and evade detection.
- inbound message
any of
filter(attachments)where:any of
filter(...)where:any of
regex.iextract(.scan.strings.raw)where any holds:- .named_groups['email_address'] is recipients.to[0].email.email
any of
strings.scan_base64(.named_groups['email_address'])where:- strings.icontains(.)
Inspects: attachments[].file_extension, recipients.to[0].email.email, type.inbound. Sensors: file.explode, regex.iextract, strings.icontains, strings.scan_base64.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | docx |
attachments[].file_extension | member | docm |
strings.icontains | substring | <w:hyperlink |
regex.iextract | regex | <w:hyperlink[^\>]*w:anchor="(?P<email_address>[^\"]+)" |