Detection rules › Sublime MQL

Attachment: EICAR string present

Severity
low
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule detects the EICAR test string, used to evaluate Anti-Virus scanning and file inspection capabilities. For performance reasons, this rule is limited to attachments with "eicar" in the file name.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware

Event coverage

Rule body MQL

type.inbound
and any(attachments, strings.icontains(.file_name, "eicar"))
and any(attachments,
        any(file.explode(.),
            any(.scan.strings.strings,
                strings.icontains(.,
                                  'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'
                )
            )
        )
)

Detection logic

Scope: inbound message.

This rule detects the EICAR test string, used to evaluate Anti-Virus scanning and file inspection capabilities. For performance reasons, this rule is limited to attachments with "eicar" in the file name.

  1. inbound message
  2. any of attachments where:
    • .file_name contains 'eicar'
  3. any of attachments where:
    • any of file.explode(.) where:
      • any of .scan.strings.strings where:
        • . contains 'X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'

Inspects: attachments[].file_name, type.inbound. Sensors: file.explode, strings.icontains.

Indicators matched (2)

FieldMatchValue
strings.icontainssubstringeicar
strings.icontainssubstringX5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*