Detection rules › Sublime MQL

Attachment: Office document loads remote document template

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Recursively scans archives and Office documents to detect remote document template injection.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware

Event coverage

Rule body MQL

type.inbound
and any(attachments,
        (
          (
            // office files
            .file_extension in~ $file_extensions_macros
            or .file_extension in~ $file_extensions_common_archives
            or (
              .file_extension is null
              and .file_type == "unknown"
              and .content_type == "application/octet-stream"
              and .size < 100000000
            )
          )
          and any(file.explode(.),
                  .flavors.mime == "text/xml"
                  and any(.scan.strings.strings,
                          regex.icontains(., "Target.{0,20}http.{0,200}dotm")
                  )
          )
        )
)

Detection logic

Scope: inbound message.

Recursively scans archives and Office documents to detect remote document template injection.

  1. inbound message
  2. any of attachments where all hold:
    • any of:
      • .file_extension in $file_extensions_macros
      • .file_extension in $file_extensions_common_archives
      • all of:
        • .file_extension is missing
        • .file_type is 'unknown'
        • .content_type is 'application/octet-stream'
        • .size < 100000000
    • any of file.explode(.) where all hold:
      • .flavors.mime is 'text/xml'
      • any of .scan.strings.strings where:
        • . matches 'Target.{0,20}http.{0,200}dotm'

Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, attachments[].size, type.inbound. Sensors: file.explode, regex.icontains. Reference lists: $file_extensions_common_archives, $file_extensions_macros.

Indicators matched (4)

FieldMatchValue
attachments[].file_typeequalsunknown
attachments[].content_typeequalsapplication/octet-stream
file.explode(attachments[])[].flavors.mimeequalstext/xml
regex.icontainsregexTarget.{0,20}http.{0,200}dotm