Detection rules › Sublime MQL
Attachment: Potential sandbox evasion in Office file
Scans attached files with known Office file extension, and alerts on the presence of strings indicative of sandbox evasion checks. Malicious code may carry out checks against the local host (e.g. running processes, disk size, domain-joined status) before running its final payload.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion, Macros |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(
.file_extension in~ $file_extensions_macros
or (
.file_extension is null
and .file_type == "unknown"
and .content_type == "application/octet-stream"
and .size < 100000000
)
)
and any(file.explode(.),
1 of (
any(.scan.strings.strings,
strings.ilike(., "*Win32_Processor*")
),
any(.scan.strings.strings,
strings.ilike(., "*Win32_LogicalDisk*")
),
any(.scan.strings.strings,
strings.ilike(., "*Win32_ComputerSystem*")
),
any(.scan.strings.strings,
strings.ilike(., "*Win32_Process*")
),
any(.scan.strings.strings,
strings.ilike(., "*LDAP://RootDSE*")
)
)
)
)
Detection logic
Scope: inbound message.
Scans attached files with known Office file extension, and alerts on the presence of strings indicative of sandbox evasion checks. Malicious code may carry out checks against the local host (e.g. running processes, disk size, domain-joined status) before running its final payload.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_extension in $file_extensions_macros
all of:
- .file_extension is missing
- .file_type is 'unknown'
- .content_type is 'application/octet-stream'
- .size < 100000000
any of
file.explode(.)where:at least 1 of:
any of
.scan.strings.stringswhere:- . matches '*Win32_Processor*'
any of
.scan.strings.stringswhere:- . matches '*Win32_LogicalDisk*'
any of
.scan.strings.stringswhere:- . matches '*Win32_ComputerSystem*'
any of
.scan.strings.stringswhere:- . matches '*Win32_Process*'
any of
.scan.strings.stringswhere:- . matches '*LDAP://RootDSE*'
Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, attachments[].size, type.inbound. Sensors: file.explode, strings.ilike. Reference lists: $file_extensions_macros.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | unknown |
attachments[].content_type | equals | application/octet-stream |
strings.ilike | substring | *Win32_Processor* |
strings.ilike | substring | *Win32_LogicalDisk* |
strings.ilike | substring | *Win32_ComputerSystem* |
strings.ilike | substring | *Win32_Process* |
strings.ilike | substring | *LDAP://RootDSE* |