Detection rules › Sublime MQL
Attachment: Employment contract update with suspicious file naming
Detects messages containing two attachments where one is a PowerPoint file with suspicious character substitution in the filename ('Empl0yment' using zero instead of 'o') and body text claiming an employment contract has been updated.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| body.current_thread |
| type |
Rule body MQL
type.inbound
// two attachments, one png and one pptx
and length(attachments) == 2
// the pptx has Empl0yment in name
and length(filter(attachments, strings.contains(.file_name, "Empl0yment"))) == 1
and strings.icontains(body.current_thread.text,
"Your Employment Contract has being updated"
)
Detection logic
Scope: inbound message.
Detects messages containing two attachments where one is a PowerPoint file with suspicious character substitution in the filename ('Empl0yment' using zero instead of 'o') and body text claiming an employment contract has been updated.
- inbound message
- length(attachments) is 2
- length(filter(attachments, strings.contains(.file_name, 'Empl0yment'))) is 1
- body.current_thread.text contains 'Your Employment Contract has being updated'
Inspects: attachments[].file_name, body.current_thread.text, type.inbound. Sensors: strings.contains, strings.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
strings.contains | substring | Empl0yment |
strings.icontains | substring | Your Employment Contract has being updated |