detection.wiki

Detection rules › Sublime MQL

Attachment: ZIP file with CVE-2026-0866 exploit

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects ZIP attachments containing exploits targeting CVE-2026-0866 vulnerability through YARA signature matching.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware
Tactics and techniquesExploit, Evasion

Event coverage

Message attribute
attachments (collection)

Rule body MQL

any(filter(attachments, .file_type == "zip"),
    any(file.explode(.),
        any(.scan.yara.matches, .name in ("zip_cve_2026_0866"))
    )
)

Detection logic

Detects ZIP attachments containing exploits targeting CVE-2026-0866 vulnerability through YARA signature matching.

any of filter(attachments) where:
  • any of file.explode(.) where:
    • any of .scan.yara.matches where:
      • .name in ('zip_cve_2026_0866')

Inspects: attachments[].file_type. Sensors: file.explode.

Indicators matched (2)

FieldMatchValue
attachments[].file_typeequalszip
file.explode(filter(attachments)[])[].scan.yara.matches[].namememberzip_cve_2026_0866