Detection rules › Sublime MQL
Attachment: Link file with UNC path
Attached link file contains a UNC path. This can be used to relay NTLM password hashes; Windows will attempt to authenticate against the path even without the file being opened.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, LNK |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
.file_extension in ("lnk", "url")
and any(file.explode(.),
any(.scan.strings.strings,
regex.icontains(.,
'\\\\([a-zA-Z0-9_:%.$-]+)\\([a-zA-Z0-9_:%.$-]+)'
)
) // normal UNC paths
or any(.scan.strings.strings,
regex.icontains(.,
'%5C%5C([a-zA-Z0-9_:%.$-]+)%5C([a-zA-Z0-9_:%.$-]+)'
)
) // percent-encoded UNC paths
)
)
Detection logic
Scope: inbound message.
Attached link file contains a UNC path. This can be used to relay NTLM password hashes; Windows will attempt to authenticate against the path even without the file being opened.
- inbound message
any of
attachmentswhere all hold:- .file_extension in ('lnk', 'url')
any of
file.explode(.)where any holds:any of
.scan.strings.stringswhere:- . matches '\\\\\\\\([a-zA-Z0-9_:%.$-]+)\\\\([a-zA-Z0-9_:%.$-]+)'
any of
.scan.strings.stringswhere:- . matches '%5C%5C([a-zA-Z0-9_:%.$-]+)%5C([a-zA-Z0-9_:%.$-]+)'
Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode, regex.icontains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | member | lnk |
attachments[].file_extension | member | url |
regex.icontains | regex | \\\\([a-zA-Z0-9_:%.$-]+)\\([a-zA-Z0-9_:%.$-]+) |
regex.icontains | regex | %5C%5C([a-zA-Z0-9_:%.$-]+)%5C([a-zA-Z0-9_:%.$-]+) |