Detection rules › Sublime MQL
Attachment: ICS with embedded document
ICS invite contains an embedded document.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion, ICS Phishing |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
.file_extension == "ics"
and strings.ilike(file.parse_text(.).text,
'*ATTACH;ENCODING=*;VALUE=BINARY*'
)
and (
strings.ilike(file.parse_text(.).text, '*FILENAME=*.doc*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.dot*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.pp*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.wbk*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.xl*')
or strings.ilike(file.parse_text(.).text, '*FILENAME=*.html*')
)
)
Detection logic
Scope: inbound message.
ICS invite contains an embedded document.
- inbound message
any of
attachmentswhere all hold:- .file_extension is 'ics'
- file.parse_text(.).text matches '*ATTACH;ENCODING=*;VALUE=BINARY*'
file.parse_text(.).text matches any of 6 patterns
*FILENAME=*.doc**FILENAME=*.dot**FILENAME=*.pp**FILENAME=*.wbk**FILENAME=*.xl**FILENAME=*.html*
Inspects: attachments[].file_extension, type.inbound. Sensors: file.parse_text, strings.ilike.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | equals | ics |
strings.ilike | substring | *ATTACH;ENCODING=*;VALUE=BINARY* |
strings.ilike | substring | *FILENAME=*.doc* |
strings.ilike | substring | *FILENAME=*.dot* |
strings.ilike | substring | *FILENAME=*.pp* |
strings.ilike | substring | *FILENAME=*.wbk* |
strings.ilike | substring | *FILENAME=*.xl* |
strings.ilike | substring | *FILENAME=*.html* |