Detection rules › Sublime MQL
Attachment: EML with Encrypted ZIP
Detects when an EML file is attached that contains an encrypted ZIP file. The encryption can be used to bypass security scanning and deliver malicious content.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Encryption, Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
// attached EML
and any(filter(attachments,
.content_type == "message/rfc822" or .file_extension in ('eml')
),
// Attached EML contains a ZIP file
any(filter(file.parse_eml(.).attachments,
.file_type == "zip" or .file_extension == "zip"
),
// ZIP file is encrypted
any(file.explode(.),
any(.flavors.yara, . == 'encrypted_zip') or .scan.zip.encrypted
)
)
)
Detection logic
Scope: inbound message.
Detects when an EML file is attached that contains an encrypted ZIP file. The encryption can be used to bypass security scanning and deliver malicious content.
- inbound message
any of
filter(attachments)where:any of
filter(...)where:any of
file.explode(.)where any holds:any of
.flavors.yarawhere:- . is 'encrypted_zip'
- .scan.zip.encrypted
Inspects: attachments[].content_type, attachments[].file_extension, type.inbound. Sensors: file.explode, file.parse_eml.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
attachments[].content_type | equals | message/rfc822 |
attachments[].file_extension | member | eml |
file.parse_eml(filter(attachments)[]).attachments[].file_type | equals | zip |
file.parse_eml(filter(attachments)[]).attachments[].file_extension | equals | zip |
file.explode(filter(...)[])[].flavors.yara[] | equals | encrypted_zip |