Detection rules › Sublime MQL
Attachment: MS OOXML file created by Administrator with zero edit time
Detects inbound PowerPoint (.pptx) and other MS OOXML attachments where the file creator is listed as 'Administrator' and the total edit time is zero minutes, while missing the 'TitlesOfParts' metadata field. This pattern may indicate programmatically generated or suspicious presentation files.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(attachments, .file_type in ("pptx", "docx")),
beta.parse_exif(.).creator == "Administrator"
and any(beta.parse_exif(.).fields,
.key == "TotalEditTime" and .value == "0"
)
and not 'TitlesOfParts' in map(beta.parse_exif(.).fields, .key)
)
Detection logic
Scope: inbound message.
Detects inbound PowerPoint (.pptx) and other MS OOXML attachments where the file creator is listed as 'Administrator' and the total edit time is zero minutes, while missing the 'TitlesOfParts' metadata field. This pattern may indicate programmatically generated or suspicious presentation files.
- inbound message
any of
filter(attachments)where all hold:- beta.parse_exif(.).creator is 'Administrator'
any of
beta.parse_exif(.).fieldswhere all hold:- .key is 'TotalEditTime'
- .value is '0'
not:
- map(...) contains 'TitlesOfParts'
Inspects: attachments[].file_type, type.inbound. Sensors: beta.parse_exif.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | member | pptx |
attachments[].file_type | member | docx |
beta.parse_exif(filter(attachments)[]).fields[].key | equals | TotalEditTime |
beta.parse_exif(filter(attachments)[]).fields[].value | equals | 0 |
map(beta.parse_exif(filter(attachments)[]).fields, filter(attachments)[].key) | contains | TitlesOfParts |