Detection rules › Sublime MQL

Attachment: SVG file execution

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects file execution attempts in SVG files. ActiveXObject is used to invoke WScript.Shell and run a program.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware
Tactics and techniquesScripting

Event coverage

Rule body MQL

type.inbound
and any(attachments,
        (
          .file_extension =~ "svg"
          or .file_extension in $file_extensions_common_archives
          or .file_type == "svg"
        )
        and any(file.explode(.),
                .file_extension == "svg"
                // Author Matt harr0ey @harr0ey
                // Topic: SVG file Execution
                // WScript inside SVG
                // <script language="JScript">
                // <![CDATA[
                // var r = new ActiveXObject("WScript.Shell").Run("calc.exe")
                // ]]>
                // </script>
                and any(.scan.strings.strings,
                        strings.icontains(., "ActiveXObject")
                )
                and any(.scan.strings.strings,
                        strings.icontains(., "WScript.Shell")
                )
                and any(.scan.strings.strings,
                        strings.like(., "*Run*", "*Execute*")
                )
        )
)

Detection logic

Scope: inbound message.

Detects file execution attempts in SVG files. ActiveXObject is used to invoke WScript.Shell and run a program.

  1. inbound message
  2. any of attachments where all hold:
    • any of:
      • .file_extension is 'svg'
      • .file_extension in $file_extensions_common_archives
      • .file_type is 'svg'
    • any of file.explode(.) where all hold:
      • .file_extension is 'svg'
      • any of .scan.strings.strings where:
        • . contains 'ActiveXObject'
      • any of .scan.strings.strings where:
        • . contains 'WScript.Shell'
      • any of .scan.strings.strings where:
        • . matches any of 2 patterns
          • *Run*
          • *Execute*

Inspects: attachments[].file_extension, attachments[].file_type, type.inbound. Sensors: file.explode, strings.icontains, strings.like. Reference lists: $file_extensions_common_archives.

Indicators matched (7)

FieldMatchValue
attachments[].file_extensionequalssvg
attachments[].file_typeequalssvg
file.explode(attachments[])[].file_extensionequalssvg
strings.icontainssubstringActiveXObject
strings.icontainssubstringWScript.Shell
strings.likesubstring*Run*
strings.likesubstring*Execute*