Detection rules › Sublime MQL

Attachment: LNK file

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Recursively scans files and archives to detect LNK connection files. LNK files can be weaponised to execute arbitrary commands including unpacking and running executable content embedded within the file itself.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware
Tactics and techniquesLNK

Event coverage

Rule body MQL

type.inbound
and any(attachments,
        .file_extension =~ "lnk"
        or (
          .file_extension in~ $file_extensions_common_archives
          and any(file.explode(.), .file_extension =~ "lnk")
        )
)

Detection logic

Scope: inbound message.

Recursively scans files and archives to detect LNK connection files. LNK files can be weaponised to execute arbitrary commands including unpacking and running executable content embedded within the file itself.

  1. inbound message
  2. any of attachments where any holds:
    • .file_extension is 'lnk'
    • all of:
      • .file_extension in $file_extensions_common_archives
      • any of file.explode(.) where:
        • .file_extension is 'lnk'

Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode. Reference lists: $file_extensions_common_archives.

Indicators matched (2)

FieldMatchValue
attachments[].file_extensionequalslnk
file.explode(attachments[])[].file_extensionequalslnk