Detection rules › Sublime MQL
Attachment: EML containing a base64 encoded script
Attached EML contains a base64 encoded script in the message body.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, HTML smuggling, Scripting, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| body.current_thread |
| sender.email |
| type |
Rule body MQL
type.inbound
and length(body.current_thread.text) < 1000
and any(attachments,
(.content_type == "message/rfc822" or .file_extension == "eml")
and strings.ilike(file.parse_eml(.).body.html.raw,
"*script*data:text/html;base64*"
)
)
// exclude bounce backs & read receipts
and not strings.like(sender.email.local_part,
"*postmaster*",
"*mailer-daemon*",
"*administrator*"
)
and not any(attachments, .content_type == "message/delivery-status")
Detection logic
Scope: inbound message.
Attached EML contains a base64 encoded script in the message body.
- inbound message
- length(body.current_thread.text) < 1000
any of
attachmentswhere all hold:any of:
- .content_type is 'message/rfc822'
- .file_extension is 'eml'
- file.parse_eml(.).body.html.raw matches '*script*data:text/html;base64*'
not:
sender.email.local_part matches any of 3 patterns
*postmaster**mailer-daemon**administrator*
not:
any of
attachmentswhere:- .content_type is 'message/delivery-status'
Inspects: attachments[].content_type, attachments[].file_extension, body.current_thread.text, sender.email.local_part, type.inbound. Sensors: file.parse_eml, strings.ilike, strings.like.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
attachments[].content_type | equals | message/rfc822 |
attachments[].file_extension | equals | eml |
strings.ilike | substring | *script*data:text/html;base64* |
strings.like | substring | *postmaster* |
strings.like | substring | *mailer-daemon* |
strings.like | substring | *administrator* |
attachments[].content_type | equals | message/delivery-status |