Detection rules › Sublime MQL
Attachment: PDF with link to DMG file download
This rule identifies PDF attachments that either link directly to a DMG file, link to a ZIP archive containing a DMG file, or link to an encrypted ZIP containing a DMG file. This technique has been observed delivering MetaStealer Malware.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion, PDF |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
.file_type == "pdf"
and any(file.explode(.),
any(.scan.url.urls,
// url links to dmg or zip
(
strings.iends_with(.url, ".dmg")
or strings.iends_with(.url, "zip")
)
// and downloads a dmg or a zip
and any(ml.link_analysis(.).files_downloaded,
(
.file_extension == "dmg"
or (
.file_extension in~ $file_extensions_common_archives
// and the zip contains a dmg file
and any(file.explode(.),
(.file_extension =~ "dmg")
// exif inspection if encrypted
or strings.ends_with(.scan.exiftool.zip_file_name,
".dmg"
)
)
)
)
)
)
)
)
and (
profile.by_sender().prevalence in ("new", "outlier")
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
Detection logic
Scope: inbound message.
This rule identifies PDF attachments that either link directly to a DMG file, link to a ZIP archive containing a DMG file, or link to an encrypted ZIP containing a DMG file. This technique has been observed delivering MetaStealer Malware.
- inbound message
any of
attachmentswhere all hold:- .file_type is 'pdf'
any of
file.explode(.)where:any of
.scan.url.urlswhere all hold:any of:
- .url ends with '.dmg'
- .url ends with 'zip'
any of
ml.link_analysis(.).files_downloadedwhere any holds:- .file_extension is 'dmg'
all of:
- .file_extension in $file_extensions_common_archives
any of
file.explode(.)where any holds:- .file_extension is 'dmg'
- .scan.exiftool.zip_file_name ends with '.dmg'
any of:
- profile.by_sender().prevalence in ('new', 'outlier')
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
Inspects: attachments[].file_type, type.inbound. Sensors: file.explode, ml.link_analysis, profile.by_sender, strings.ends_with, strings.iends_with. Reference lists: $file_extensions_common_archives.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
strings.iends_with | suffix | .dmg |
strings.iends_with | suffix | zip |
ml.link_analysis(file.explode(attachments[])[].scan.url.urls[]).files_downloaded[].file_extension | equals | dmg |
file.explode(ml.link_analysis(file.explode(attachments[])[].scan.url.urls[]).files_downloaded[])[].file_extension | equals | dmg |
strings.ends_with | suffix | .dmg |