detection.wiki

Detection rules › Sublime MQL

Attachment: Excel file with suspicious template identifier

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects Excel attachments containing a specific template identifier (TM16390866) in the EXIF metadata, which may indicate malicious or suspicious document templates being used to distribute harmful content.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, Macros

Event coverage

Message attribute
attachments (collection)
type

Rule body MQL

type.inbound
and any(attachments,
        .file_type == "xlsx"
        and any(beta.parse_exif(.).fields,
                .key == "Template" and .value == "TM16390866"
        )
)

Detection logic

Scope: inbound message.

Detects Excel attachments containing a specific template identifier (TM16390866) in the EXIF metadata, which may indicate malicious or suspicious document templates being used to distribute harmful content.

  1. inbound message
  2. any of attachments where all hold:
    • .file_type is 'xlsx'
    • any of beta.parse_exif(.).fields where all hold:
      • .key is 'Template'
      • .value is 'TM16390866'

Inspects: attachments[].file_type, type.inbound. Sensors: beta.parse_exif.

Indicators matched (3)

FieldMatchValue
attachments[].file_typeequalsxlsx
beta.parse_exif(attachments[]).fields[].keyequalsTemplate
beta.parse_exif(attachments[]).fields[].valueequalsTM16390866