Detection rules › Sublime MQL

Attachment: Filename containing Unicode braille pattern blank character

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Recursively identifies attachments that attempt to conceal their true file extension by using Braille Pattern Blank characters

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware
Tactics and techniquesEvasion

Event coverage

Rule body MQL

type.inbound
and any(attachments,
        regex.icontains(.file_name, '\x{2800}')
        or (
          .file_extension in~ $file_extensions_common_archives
          and any(file.explode(.), regex.icontains(.file_name, '\x{2800}'))
        )
)

Detection logic

Scope: inbound message.

Recursively identifies attachments that attempt to conceal their true file extension by using Braille Pattern Blank characters

  1. inbound message
  2. any of attachments where any holds:
    • .file_name matches '\\x{2800}'
    • all of:
      • .file_extension in $file_extensions_common_archives
      • any of file.explode(.) where:
        • .file_name matches '\\x{2800}'

Inspects: attachments[].file_extension, attachments[].file_name, type.inbound. Sensors: file.explode, regex.icontains. Reference lists: $file_extensions_common_archives.

Indicators matched (1)

FieldMatchValue
regex.icontainsregex\x{2800}