Detection rules › Sublime MQL
Attachment: Archive contains DLL-loading macro
An attacker could send a trusted and signed document that references an untrusted DLL file, which will be loaded by the signed document.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Exploit, LNK, Macros, Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ $file_extensions_common_archives
or .file_type == "rar"
)
and (
(
any(file.explode(.),
.scan.zip.encrypted == false
// zip contains a dll file
and any(.scan.zip.all_paths, strings.icontains(., "dll"))
)
and any(file.explode(.),
// macro references a dll file
any(.flavors.yara, strings.like(., "vb_file"))
and any(.scan.strings.strings, strings.icontains(., "dll"))
)
)
or any(file.explode(.), // fallback for encrypted zips
.scan.zip.encrypted == true
and any(.scan.zip.all_paths,
any($file_extensions_macros, strings.icontains(.., .))
)
// zip contains a dll file
and any(.scan.zip.all_paths, strings.icontains(., "dll"))
)
or (
any(file.explode(.),
any(.flavors.yara, strings.like(., "vb_file"))
and any(.scan.strings.strings, strings.ilike(., "*Lib*.dll*"))
)
and any(file.explode(.), strings.ilike(.file_extension, "dll"))
)
)
)
Detection logic
Scope: inbound message.
An attacker could send a trusted and signed document that references an untrusted DLL file, which will be loaded by the signed document.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in $file_extensions_common_archives
- .file_type is 'rar'
any of:
all of:
any of
file.explode(.)where all hold:- .scan.zip.encrypted is False
any of
.scan.zip.all_pathswhere:- . contains 'dll'
any of
file.explode(.)where all hold:any of
.flavors.yarawhere:- . matches 'vb_file'
any of
.scan.strings.stringswhere:- . contains 'dll'
any of
file.explode(.)where all hold:- .scan.zip.encrypted is True
any of
.scan.zip.all_pathswhere:any of
$file_extensions_macroswhere:- strings.icontains(.)
any of
.scan.zip.all_pathswhere:- . contains 'dll'
all of:
any of
file.explode(.)where all hold:any of
.flavors.yarawhere:- . matches 'vb_file'
any of
.scan.strings.stringswhere:- . matches '*Lib*.dll*'
any of
file.explode(.)where:- .file_extension matches 'dll'
Inspects: attachments[].file_extension, attachments[].file_type, type.inbound. Sensors: file.explode, strings.icontains, strings.ilike, strings.like. Reference lists: $file_extensions_common_archives, $file_extensions_macros.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | rar |
strings.icontains | substring | dll |
strings.like | substring | vb_file |
strings.ilike | substring | *Lib*.dll* |
strings.ilike | substring | dll |