Detection rules › Sublime MQL
Attachment: PowerPoint with suspicious hyperlink
Attached PowerPoint contains a suspicious hyperlink that can execute arbitrary code.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion, Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(.file_extension in~ ("ppt", "pptx"))
and any(file.explode(.),
any(.scan.exiftool.fields,
.key == "Hyperlinks"
and (
4 of (
strings.ilike(.value, "*[Convert]::ToChar*"),
strings.ilike(.value, "*vbs*"),
strings.ilike(.value, "*[IO.File]::Create*"),
strings.ilike(.value, "*[IO.File]::Exists*"),
strings.ilike(.value,
"*[io.FileOPtions]::DeleteOnClose*"
),
strings.ilike(.value, "*Net.WebClient*"),
strings.ilike(.value, "*dll*"),
)
)
)
)
)
Detection logic
Scope: inbound message.
Attached PowerPoint contains a suspicious hyperlink that can execute arbitrary code.
- inbound message
any of
attachmentswhere all hold:- .file_extension in ('ppt', 'pptx')
any of
file.explode(.)where:any of
.scan.exiftool.fieldswhere all hold:- .key is 'Hyperlinks'
at least 4 of 7: .value matches any of 7 patterns
*[Convert]::ToChar**vbs**[IO.File]::Create**[IO.File]::Exists**[io.FileOPtions]::DeleteOnClose**Net.WebClient**dll*
Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode, strings.ilike.
Indicators matched (10)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | ppt |
attachments[].file_extension | member | pptx |
file.explode(attachments[])[].scan.exiftool.fields[].key | equals | Hyperlinks |
strings.ilike | substring | *[Convert]::ToChar* |
strings.ilike | substring | *vbs* |
strings.ilike | substring | *[IO.File]::Create* |
strings.ilike | substring | *[IO.File]::Exists* |
strings.ilike | substring | *[io.FileOPtions]::DeleteOnClose* |
strings.ilike | substring | *Net.WebClient* |
strings.ilike | substring | *dll* |