Detection rules › Sublime MQL

Attachment: Macro files containing MHT content

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects macro-enabled files that contain embedded MHT (MIME HTML) content, which is commonly used to hide malicious code through file format manipulation.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware, Credential Phishing
Tactics and techniquesEvasion, Macros, Scripting

Event coverage

Rule body MQL

type.inbound
and any(attachments,
        .file_extension in $file_extensions_macros
        and any(file.explode(.),
                .file_extension == "mht"
                and not .flavors.mime == "message/rfc822"
        )
)

Detection logic

Scope: inbound message.

Detects macro-enabled files that contain embedded MHT (MIME HTML) content, which is commonly used to hide malicious code through file format manipulation.

  1. inbound message
  2. any of attachments where all hold:
    • .file_extension in $file_extensions_macros
    • any of file.explode(.) where all hold:
      • .file_extension is 'mht'
      • not:
        • .flavors.mime is 'message/rfc822'

Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode. Reference lists: $file_extensions_macros.

Indicators matched (2)

FieldMatchValue
file.explode(attachments[])[].file_extensionequalsmht
file.explode(attachments[])[].flavors.mimeequalsmessage/rfc822