Detection rules › Sublime MQL

Attachment: LNK with embedded content

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Emotet has been observed to embed executable content within an LNK file to deliver and execute VBScript when launched. Similar research has demonstrated how this concept may be applied to deliver and launch an embedded executable via PowerShell.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware
Tactics and techniquesExploit, LNK, Scripting

Event coverage

Rule body MQL

type.inbound
and (
  any(attachments,
      .file_extension == "lnk"
      and any(file.explode(.),
              .file_extension =~ "lnk"
              and any(.scan.exiftool.fields,
                      (.key == "TargetFileSize" and .value == "0")
              )
              and any(.scan.exiftool.fields,
                      (
                        .key == "CommandLineArguments"
                        and strings.ilike(.value,
                                          "*findstr*",
                                          "*sc $path*",
                                          "*Set-Content*"
                        )
                      )
              )
      )
  )
)

Detection logic

Scope: inbound message.

Emotet has been observed to embed executable content within an LNK file to deliver and execute VBScript when launched. Similar research has demonstrated how this concept may be applied to deliver and launch an embedded executable via PowerShell.

  1. inbound message
  2. any of attachments where all hold:
    • .file_extension is 'lnk'
    • any of file.explode(.) where all hold:
      • .file_extension is 'lnk'
      • any of .scan.exiftool.fields where all hold:
        • .key is 'TargetFileSize'
        • .value is '0'
      • any of .scan.exiftool.fields where all hold:
        • .key is 'CommandLineArguments'
        • .value matches any of 3 patterns
          • *findstr*
          • *sc $path*
          • *Set-Content*

Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode, strings.ilike.

Indicators matched (8)

FieldMatchValue
attachments[].file_extensionequalslnk
file.explode(attachments[])[].file_extensionequalslnk
file.explode(attachments[])[].scan.exiftool.fields[].keyequalsTargetFileSize
file.explode(attachments[])[].scan.exiftool.fields[].valueequals0
file.explode(attachments[])[].scan.exiftool.fields[].keyequalsCommandLineArguments
strings.ilikesubstring*findstr*
strings.ilikesubstring*sc $path*
strings.ilikesubstring*Set-Content*