detection.wiki

Detection rules › Sublime MQL

MalwareBazaar: Malicious attachment hash in archive (trusted reporters)

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects if an arhive attachments contains a file that matches a SHA256 hash reported as malware on MalwareBazaar by trusted reporters.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware
Tactics and techniquesEvasion

Event coverage

Message attribute
attachments (collection)
type

Rule body MQL

type.inbound
and any(attachments,
        .file_extension in~ $file_extensions_common_archives
        and any(file.explode(.),
                .scan.hash.sha256 in $abuse_ch_malwarebazaar_sha256_trusted_reporters
        )
)

Detection logic

Scope: inbound message.

Detects if an arhive attachments contains a file that matches a SHA256 hash reported as malware on MalwareBazaar by trusted reporters.

  1. inbound message
  2. any of attachments where all hold:
    • .file_extension in $file_extensions_common_archives
    • any of file.explode(.) where:
      • .scan.hash.sha256 in $abuse_ch_malwarebazaar_sha256_trusted_reporters

Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode. Reference lists: $abuse_ch_malwarebazaar_sha256_trusted_reporters, $file_extensions_common_archives.