Detection rules › Sublime MQL
Attachment: Double base64-encoded zip file in HTML smuggling attachment
Qakbot double Base64 encodes zip files within their HTML smuggling email attachments. This leads to predictable file header strings appearing in the HTML string content.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware, Credential Phishing |
| Tactics and techniques | Evasion, HTML smuggling, Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
.file_extension in ("html", "htm")
and any(file.explode(.),
any(.scan.strings.strings,
strings.ilike(.,
// Double Base64 encoded zips
"*VUVzREJCUUFBUUFJQ*",
"*VFc0RCQlFBQVFBSU*",
"*VRXNEQkJRQUFRQUlB*",
// Reversed base64 strings double encoded zips
"*QJFUUBFUUCJERzVUV*",
"*USBFVQBFlQCR0cFV*",
"*BlUQRFUQRJkQENXRV*"
)
)
)
)
Detection logic
Scope: inbound message.
Qakbot double Base64 encodes zip files within their HTML smuggling email attachments. This leads to predictable file header strings appearing in the HTML string content.
- inbound message
any of
attachmentswhere all hold:- .file_extension in ('html', 'htm')
any of
file.explode(.)where:any of
.scan.strings.stringswhere:. matches any of 6 patterns
*VUVzREJCUUFBUUFJQ**VFc0RCQlFBQVFBSU**VRXNEQkJRQUFRQUlB**QJFUUBFUUCJERzVUV**USBFVQBFlQCR0cFV**BlUQRFUQRJkQENXRV*
Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode, strings.ilike.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | html |
attachments[].file_extension | member | htm |
strings.ilike | substring | *VUVzREJCUUFBUUFJQ* |
strings.ilike | substring | *VFc0RCQlFBQVFBSU* |
strings.ilike | substring | *VRXNEQkJRQUFRQUlB* |
strings.ilike | substring | *QJFUUBFUUCJERzVUV* |
strings.ilike | substring | *USBFVQBFlQCR0cFV* |
strings.ilike | substring | *BlUQRFUQRJkQENXRV* |