Detection rules › Sublime MQL
Attachment: Fake Slack installer
HTML attachment contains a Slack logo, request language, and a link to an executable. Observed in the wild.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion, HTML smuggling, Impersonation: Brand, Scripting, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and (
any(attachments,
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or .file_type == "html"
or .content_type == "text/html"
)
and any(ml.logo_detect(file.html_screenshot(.)).brands,
.name == "Slack" and .confidence in ("medium", "high")
)
and any(ml.nlu_classifier(file.parse_html(.).display_text).entities,
.name == "request" and .text =~ "download"
)
and any(file.explode(.),
any(.scan.url.urls,
strings.iends_with(.path, ".exe")
and .domain.root_domain not in $org_domains
)
)
)
)
Detection logic
Scope: inbound message.
HTML attachment contains a Slack logo, request language, and a link to an executable. Observed in the wild.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in ('html', 'htm', 'shtml', 'dhtml')
- .file_type is 'html'
- .content_type is 'text/html'
any of
ml.logo_detect(file.html_screenshot(.)).brandswhere all hold:- .name is 'Slack'
- .confidence in ('medium', 'high')
any of
ml.nlu_classifier(file.parse_html(.).display_text).entitieswhere all hold:- .name is 'request'
- .text is 'download'
any of
file.explode(.)where:any of
.scan.url.urlswhere all hold:- .path ends with '.exe'
- .domain.root_domain not in $org_domains
Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, type.inbound. Sensors: file.explode, file.html_screenshot, file.parse_html, ml.logo_detect, ml.nlu_classifier, strings.iends_with. Reference lists: $org_domains.
Indicators matched (12)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | html |
attachments[].file_extension | member | htm |
attachments[].file_extension | member | shtml |
attachments[].file_extension | member | dhtml |
attachments[].file_type | equals | html |
attachments[].content_type | equals | text/html |
ml.logo_detect(file.html_screenshot(attachments[])).brands[].name | equals | Slack |
ml.logo_detect(file.html_screenshot(attachments[])).brands[].confidence | member | medium |
ml.logo_detect(file.html_screenshot(attachments[])).brands[].confidence | member | high |
ml.nlu_classifier(file.parse_html(attachments[]).display_text).entities[].name | equals | request |
ml.nlu_classifier(file.parse_html(attachments[]).display_text).entities[].text | equals | download |
strings.iends_with | suffix | .exe |