Detection rules › Sublime MQL
Attachment: LNK with embedded content
Emotet has been observed to embed executable content within an LNK file to deliver and execute VBScript when launched. Similar research has demonstrated how this concept may be applied to deliver and launch an embedded executable via PowerShell.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Exploit, LNK, Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and (
any(attachments,
.file_extension == "lnk"
and any(file.explode(.),
.file_extension =~ "lnk"
and any(.scan.exiftool.fields,
(.key == "TargetFileSize" and .value == "0")
)
and any(.scan.exiftool.fields,
(
.key == "CommandLineArguments"
and strings.ilike(.value,
"*findstr*",
"*sc $path*",
"*Set-Content*"
)
)
)
)
)
)
Detection logic
Scope: inbound message.
Emotet has been observed to embed executable content within an LNK file to deliver and execute VBScript when launched. Similar research has demonstrated how this concept may be applied to deliver and launch an embedded executable via PowerShell.
- inbound message
any of
attachmentswhere all hold:- .file_extension is 'lnk'
any of
file.explode(.)where all hold:- .file_extension is 'lnk'
any of
.scan.exiftool.fieldswhere all hold:- .key is 'TargetFileSize'
- .value is '0'
any of
.scan.exiftool.fieldswhere all hold:- .key is 'CommandLineArguments'
.value matches any of 3 patterns
*findstr**sc $path**Set-Content*
Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode, strings.ilike.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | equals | lnk |
file.explode(attachments[])[].file_extension | equals | lnk |
file.explode(attachments[])[].scan.exiftool.fields[].key | equals | TargetFileSize |
file.explode(attachments[])[].scan.exiftool.fields[].value | equals | 0 |
file.explode(attachments[])[].scan.exiftool.fields[].key | equals | CommandLineArguments |
strings.ilike | substring | *findstr* |
strings.ilike | substring | *sc $path* |
strings.ilike | substring | *Set-Content* |