Detection rules › Sublime MQL

Attachment: MS OOXML file created by Administrator with zero edit time

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound PowerPoint (.pptx) and other MS OOXML attachments where the file creator is listed as 'Administrator' and the total edit time is zero minutes, while missing the 'TitlesOfParts' metadata field. This pattern may indicate programmatically generated or suspicious presentation files.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware
Tactics and techniquesEvasion

Event coverage

Rule body MQL

type.inbound
and any(filter(attachments, .file_type in ("pptx", "docx")),
        beta.parse_exif(.).creator == "Administrator"
        and any(beta.parse_exif(.).fields,
                .key == "TotalEditTime" and .value == "0"
        )
        and not 'TitlesOfParts' in map(beta.parse_exif(.).fields, .key)
)

Detection logic

Scope: inbound message.

Detects inbound PowerPoint (.pptx) and other MS OOXML attachments where the file creator is listed as 'Administrator' and the total edit time is zero minutes, while missing the 'TitlesOfParts' metadata field. This pattern may indicate programmatically generated or suspicious presentation files.

  1. inbound message
  2. any of filter(attachments) where all hold:
    • beta.parse_exif(.).creator is 'Administrator'
    • any of beta.parse_exif(.).fields where all hold:
      • .key is 'TotalEditTime'
      • .value is '0'
    • not:
      • map(...) contains 'TitlesOfParts'

Inspects: attachments[].file_type, type.inbound. Sensors: beta.parse_exif.

Indicators matched (5)

FieldMatchValue
attachments[].file_typememberpptx
attachments[].file_typememberdocx
beta.parse_exif(filter(attachments)[]).fields[].keyequalsTotalEditTime
beta.parse_exif(filter(attachments)[]).fields[].valueequals0
map(beta.parse_exif(filter(attachments)[]).fields, filter(attachments)[].key)containsTitlesOfParts