Detection rules › Sublime MQL
Attachment: Filename containing Unicode braille pattern blank character
Recursively identifies attachments that attempt to conceal their true file extension by using Braille Pattern Blank characters
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
regex.icontains(.file_name, '\x{2800}')
or (
.file_extension in~ $file_extensions_common_archives
and any(file.explode(.), regex.icontains(.file_name, '\x{2800}'))
)
)
Detection logic
Scope: inbound message.
Recursively identifies attachments that attempt to conceal their true file extension by using Braille Pattern Blank characters
- inbound message
any of
attachmentswhere any holds:- .file_name matches '\\x{2800}'
all of:
- .file_extension in $file_extensions_common_archives
any of
file.explode(.)where:- .file_name matches '\\x{2800}'
Inspects: attachments[].file_extension, attachments[].file_name, type.inbound. Sensors: file.explode, regex.icontains. Reference lists: $file_extensions_common_archives.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | \x{2800} |