Detection rules › Sublime MQL
Attachment: SFX archive containing commands
Attachment is an SFX archive that contains commands that will execute when opened. This can be used to run malicious commands, and has been observed in the wild.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion, Scripting |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
.file_extension in~ ("exe", "sfx")
and any(file.explode(.),
any(.scan.strings.strings,
strings.ilike(.,
'CMT;The comment below contains SFX script commands'
)
)
and any(.scan.strings.strings, strings.ilike(., 'Setup=*'))
)
)
Detection logic
Scope: inbound message.
Attachment is an SFX archive that contains commands that will execute when opened. This can be used to run malicious commands, and has been observed in the wild.
- inbound message
any of
attachmentswhere all hold:- .file_extension in ('exe', 'sfx')
any of
file.explode(.)where all hold:any of
.scan.strings.stringswhere:- . matches 'CMT;The comment below contains SFX script commands'
any of
.scan.strings.stringswhere:- . matches 'Setup=*'
Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode, strings.ilike.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | exe |
attachments[].file_extension | member | sfx |
strings.ilike | substring | CMT;The comment below contains SFX script commands |
strings.ilike | substring | Setup=* |