Detection rules › Sublime MQL

Attachment: PDF with link to DMG file download

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

This rule identifies PDF attachments that either link directly to a DMG file, link to a ZIP archive containing a DMG file, or link to an encrypted ZIP containing a DMG file. This technique has been observed delivering MetaStealer Malware.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware
Tactics and techniquesEvasion, PDF

Event coverage

Rule body MQL

type.inbound
and any(attachments,
        .file_type == "pdf"
        and any(file.explode(.),
                any(.scan.url.urls,

                    // url links to dmg or zip
                    (
                      strings.iends_with(.url, ".dmg")
                      or strings.iends_with(.url, "zip")
                    )

                    // and downloads a dmg or a zip
                    and any(ml.link_analysis(.).files_downloaded,
                            (
                              .file_extension == "dmg"
                              or (
                                .file_extension in~ $file_extensions_common_archives

                                // and the zip contains a dmg file
                                and any(file.explode(.),
                                        (.file_extension =~ "dmg")

                                        // exif inspection if encrypted
                                        or strings.ends_with(.scan.exiftool.zip_file_name,
                                                             ".dmg"
                                        )
                                )
                              )
                            )
                    )
                )
        )
)
and (
  profile.by_sender().prevalence in ("new", "outlier")
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

Detection logic

Scope: inbound message.

This rule identifies PDF attachments that either link directly to a DMG file, link to a ZIP archive containing a DMG file, or link to an encrypted ZIP containing a DMG file. This technique has been observed delivering MetaStealer Malware.

  1. inbound message
  2. any of attachments where all hold:
    • .file_type is 'pdf'
    • any of file.explode(.) where:
      • any of .scan.url.urls where all hold:
        • any of:
          • .url ends with '.dmg'
          • .url ends with 'zip'
        • any of ml.link_analysis(.).files_downloaded where any holds:
          • .file_extension is 'dmg'
          • all of:
            • .file_extension in $file_extensions_common_archives
            • any of file.explode(.) where any holds:
              • .file_extension is 'dmg'
              • .scan.exiftool.zip_file_name ends with '.dmg'
  3. any of:
    • profile.by_sender().prevalence in ('new', 'outlier')
    • all of:
      • profile.by_sender().any_messages_malicious_or_spam
      • not:
        • profile.by_sender().any_messages_benign

Inspects: attachments[].file_type, type.inbound. Sensors: file.explode, ml.link_analysis, profile.by_sender, strings.ends_with, strings.iends_with. Reference lists: $file_extensions_common_archives.

Indicators matched (6)

FieldMatchValue
attachments[].file_typeequalspdf
strings.iends_withsuffix.dmg
strings.iends_withsuffixzip
ml.link_analysis(file.explode(attachments[])[].scan.url.urls[]).files_downloaded[].file_extensionequalsdmg
file.explode(ml.link_analysis(file.explode(attachments[])[].scan.url.urls[]).files_downloaded[])[].file_extensionequalsdmg
strings.ends_withsuffix.dmg