Detection rules › Sublime MQL
Attachment: RTF with embedded content
RTF files can contain embedded content similar to OLE files (Microsoft Office documents.)
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
.file_type == "rtf"
and any(file.explode(.),
.flavors.mime in~ (
"application/x-dosexec",
"text/x-msdos-batch",
"application/octet-stream"
)
or any(.flavors.yara, . == 'base64_pe')
or .file_extension in~ ("bat", "exe", "vbs")
)
)
Detection logic
Scope: inbound message.
RTF files can contain embedded content similar to OLE files (Microsoft Office documents.)
- inbound message
any of
attachmentswhere all hold:- .file_type is 'rtf'
any of
file.explode(.)where any holds:- .flavors.mime in ('application/x-dosexec', 'text/x-msdos-batch', 'application/octet-stream')
any of
.flavors.yarawhere:- . is 'base64_pe'
- .file_extension in ('bat', 'exe', 'vbs')
Inspects: attachments[].file_type, type.inbound. Sensors: file.explode.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | rtf |
file.explode(attachments[])[].flavors.mime | member | application/x-dosexec |
file.explode(attachments[])[].flavors.mime | member | text/x-msdos-batch |
file.explode(attachments[])[].flavors.mime | member | application/octet-stream |
file.explode(attachments[])[].flavors.yara[] | equals | base64_pe |
file.explode(attachments[])[].file_extension | member | bat |
file.explode(attachments[])[].file_extension | member | exe |
file.explode(attachments[])[].file_extension | member | vbs |