Detection rules › Sublime MQL

Attachment: JPEG with gd-jpeg creator and suspicious file name

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages containing a single JPEG attachment with specific filename patterns and EXIF metadata indicating creation by gd-jpeg v1.0. This has been observed being used to produce company logos used within phishing messages.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion

Event coverage

Rule body MQL

type.inbound
and length(filter(attachments, .file_type == "jpg")) == 1
and any(attachments,
        .file_type == "jpg"
        and .file_extension == "jpeg"
        and strings.icontains(.file_name, 'images')
        and (
          strings.count(.file_name, '/') == 1
          or strings.count(.file_name, 'image') == 2
        )
        and any(beta.parse_exif(.).fields,
                .key =~ "Comment"
                and strings.istarts_with(.value, 'CREATOR: gd-jpeg v1.0')
        )
)

Detection logic

Scope: inbound message.

Detects inbound messages containing a single JPEG attachment with specific filename patterns and EXIF metadata indicating creation by gd-jpeg v1.0. This has been observed being used to produce company logos used within phishing messages.

  1. inbound message
  2. length(filter(attachments, .file_type == 'jpg')) is 1
  3. any of attachments where all hold:
    • .file_type is 'jpg'
    • .file_extension is 'jpeg'
    • .file_name contains 'images'
    • any of:
      • strings.count(.file_name, '/') is 1
      • strings.count(.file_name, 'image') is 2
    • any of beta.parse_exif(.).fields where all hold:
      • .key is 'Comment'
      • .value starts with 'CREATOR: gd-jpeg v1.0'

Inspects: attachments[].file_extension, attachments[].file_name, attachments[].file_type, type.inbound. Sensors: beta.parse_exif, strings.count, strings.icontains, strings.istarts_with.

Indicators matched (5)

FieldMatchValue
attachments[].file_typeequalsjpg
attachments[].file_extensionequalsjpeg
strings.icontainssubstringimages
beta.parse_exif(attachments[]).fields[].keyequalsComment
strings.istarts_withprefixCREATOR: gd-jpeg v1.0