Detection rules › Sublime MQL

Attachment: Double base64-encoded zip file in HTML smuggling attachment

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Qakbot double Base64 encodes zip files within their HTML smuggling email attachments. This leads to predictable file header strings appearing in the HTML string content.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware, Credential Phishing
Tactics and techniquesEvasion, HTML smuggling, Scripting

Event coverage

Rule body MQL

type.inbound
and any(attachments,
        .file_extension in ("html", "htm")
        and any(file.explode(.),
                any(.scan.strings.strings,
                    strings.ilike(.,
                                  // Double Base64 encoded zips
                                  "*VUVzREJCUUFBUUFJQ*",
                                  "*VFc0RCQlFBQVFBSU*",
                                  "*VRXNEQkJRQUFRQUlB*",
                                  // Reversed base64 strings double encoded zips
                                  "*QJFUUBFUUCJERzVUV*",
                                  "*USBFVQBFlQCR0cFV*",
                                  "*BlUQRFUQRJkQENXRV*"
                    )
                )
        )
)

Detection logic

Scope: inbound message.

Qakbot double Base64 encodes zip files within their HTML smuggling email attachments. This leads to predictable file header strings appearing in the HTML string content.

  1. inbound message
  2. any of attachments where all hold:
    • .file_extension in ('html', 'htm')
    • any of file.explode(.) where:
      • any of .scan.strings.strings where:
        • . matches any of 6 patterns
          • *VUVzREJCUUFBUUFJQ*
          • *VFc0RCQlFBQVFBSU*
          • *VRXNEQkJRQUFRQUlB*
          • *QJFUUBFUUCJERzVUV*
          • *USBFVQBFlQCR0cFV*
          • *BlUQRFUQRJkQENXRV*

Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode, strings.ilike.

Indicators matched (8)

FieldMatchValue
attachments[].file_extensionmemberhtml
attachments[].file_extensionmemberhtm
strings.ilikesubstring*VUVzREJCUUFBUUFJQ*
strings.ilikesubstring*VFc0RCQlFBQVFBSU*
strings.ilikesubstring*VRXNEQkJRQUFRQUlB*
strings.ilikesubstring*QJFUUBFUUCJERzVUV*
strings.ilikesubstring*USBFVQBFlQCR0cFV*
strings.ilikesubstring*BlUQRFUQRJkQENXRV*