Detection rules › Sublime MQL
Attachment: File execution via Javascript
Javascript contains identifiers or strings that may attempt to execute files.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion, Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
.file_type in $file_extensions_common_archives
and any(file.explode(.),
any(.scan.javascript.identifiers,
strings.ilike(., 'ActiveXObject', 'ShellExecute')
)
or (
length(.scan.javascript.strings) > 0
and all(.scan.javascript.strings,
strings.ilike(., 'Shell.Application', '*.exe')
)
)
)
)
Detection logic
Scope: inbound message.
Javascript contains identifiers or strings that may attempt to execute files.
- inbound message
any of
attachmentswhere all hold:- .file_type in $file_extensions_common_archives
any of
file.explode(.)where any holds:any of
.scan.javascript.identifierswhere:. matches any of 2 patterns
ActiveXObjectShellExecute
all of:
- length(.scan.javascript.strings) > 0
all of
.scan.javascript.stringswhere:. matches any of 2 patterns
Shell.Application*.exe
Inspects: attachments[].file_type, type.inbound. Sensors: file.explode, strings.ilike. Reference lists: $file_extensions_common_archives.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | ActiveXObject |
strings.ilike | substring | ShellExecute |
strings.ilike | substring | Shell.Application |
strings.ilike | substring | *.exe |