Detection rules › Sublime MQL
Attachment: MS Office or RTF file with Shell.Explorer.1 com object with embedded LNK
Detects embedded Shell.Explorer.1 COM objects containing LNK files within various file types.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
(.file_type == "rtf" or .file_extension in $file_extensions_macros)
and any(file.explode(.),
any(.scan.yara.matches,
strings.starts_with(.name, "ShellExplorer1_LNK_")
)
)
)
Detection logic
Scope: inbound message.
Detects embedded Shell.Explorer.1 COM objects containing LNK files within various file types.
- inbound message
any of
attachmentswhere all hold:any of:
- .file_type is 'rtf'
- .file_extension in $file_extensions_macros
any of
file.explode(.)where:any of
.scan.yara.matcheswhere:- .name starts with 'ShellExplorer1_LNK_'
Inspects: attachments[].file_extension, attachments[].file_type, type.inbound. Sensors: file.explode, strings.starts_with. Reference lists: $file_extensions_macros.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | rtf |
strings.starts_with | prefix | ShellExplorer1_LNK_ |