Detection rules › Sublime MQL
Attachment: XLSX file with suspicious print titles metadata
Detects XLSX attachments containing EXIF metadata with suspicious TitlesOfParts fields that follow a specific pattern combining 'Company_Name' with extracted values and 'Print_Titles', potentially indicating malicious document preparation.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Macros |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(attachments, .file_type == "xlsx"),
// get the TitleOfParts (Excel Docs this is Worksheet names)
// https://learn.microsoft.com/en-us/openspecs/office_standards/ms-oi29500/de32de14-9573-46f3-9f38-19659e3a8d9a
any(filter(beta.parse_exif(.).fields, .key == "TitlesOfParts"),
// extract the first sheet name
any(regex.iextract(.value, '^\[\"(?P<first_sheet>[^\"]+)\"'),
// check that the first sheet name is observed in the last sheet name with !print_title and comes after a sheet named "Company_Name"
strings.ends_with(..value,
strings.concat("Company_Name\",\"",
.named_groups["first_sheet"],
'!Print_Titles"]'
)
)
)
)
)
Detection logic
Scope: inbound message.
Detects XLSX attachments containing EXIF metadata with suspicious TitlesOfParts fields that follow a specific pattern combining 'Company_Name' with extracted values and 'Print_Titles', potentially indicating malicious document preparation.
- inbound message
any of
filter(attachments)where:any of
filter(...)where:any of
regex.iextract(.value)where:- strings.ends_with(.value)
Inspects: attachments[].file_type, type.inbound. Sensors: beta.parse_exif, regex.iextract, strings.concat, strings.ends_with.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | xlsx |
beta.parse_exif(filter(attachments)[]).fields[].key | equals | TitlesOfParts |
regex.iextract | regex | ^\[\"(?P<first_sheet>[^\"]+)\" |