Detection rules › Sublime MQL

Sublime MQL rules: cve

Rule	Severity
Attachment: CVE-2021-40444 - MSHTML Remote Code Execution Vulnerability	`critical`
Attachment: CVE-2025-24071 - Microsoft Windows File Explorer Spoofing Vulnerability	`critical`

Attachment: CVE-2021-40444 - MSHTML Remote Code Execution Vulnerability

Severity: critical
Type: rule
Source: github.com/sublime-security/sublime-rules

Attachment contains an external relationship that attempts to load a remote OLE object, consistent with use in CVE-2021-40444. On September 7, 2021, Microsoft released details about a zero day RCE vulnerability in MSHTML that affects Microsoft Windows. According to Microsoft: "we are aware of targeted attacks that attempt to exploit this vulnerability by using specially-crafted Microsoft Office documents. An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine."

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Malware/Ransomware
Tactics and techniques	Exploit, Macros, Scripting

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

attachments
type

Rule body

type.inbound
and any(attachments,
        (
          (
            .file_extension in~ $file_extensions_macros
            or .file_extension =~ "rtf"
            or (
              .file_extension is null
              and .file_type == "unknown"
              and .content_type == "application/octet-stream"
              and .size < 100000000
            )
          )
          and any(file.oletools(.).relationships,
                  regex.icontains(.target, ".*html:http.*")
          )
        )
        or (
          .file_extension in~ $file_extensions_common_archives
          and any(file.explode(.),
                  .flavors.mime == "text/xml"
                  and any(.scan.strings.strings,
                          regex.icontains(., ".*oleObject.*mhtml.*http.*")
                  )
          )
        )
)

Detection logic

Scope: inbound message.

inbound message
any of attachments where any holds:
- all of:
  - any of:
    
    .file_extension in $file_extensions_macros
    .file_extension is 'rtf'
    all of:
    
    .file_extension is missing
    .file_type is 'unknown'
    .content_type is 'application/octet-stream'
    .size < 100000000
  - any of file.oletools(.).relationships where:
    
    .target matches '.*html:http.*'
- all of:
  - .file_extension in $file_extensions_common_archives
  - any of file.explode(.) where all hold:
    
    .flavors.mime is 'text/xml'
    any of .scan.strings.strings where:
    
    . matches '.*oleObject.*mhtml.*http.*'

Inspects: attachments[].content_type, attachments[].file_extension, attachments[].file_type, attachments[].size, type.inbound. Sensors: file.explode, file.oletools, regex.icontains. Reference lists: $file_extensions_common_archives, $file_extensions_macros.

Indicators matched (6)

Field	Match	Value
`attachments[].file_extension`	equals	`rtf`
`attachments[].file_type`	equals	`unknown`
`attachments[].content_type`	equals	`application/octet-stream`
`regex.icontains`	regex	`.html:http.`
`file.explode(attachments[])[].flavors.mime`	equals	`text/xml`
`regex.icontains`	regex	`.oleObject.mhtml.http.`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(attachments)
    or
      and
        any(file.explode(attachments))
          and
            any(file.explode(attachments).scan.strings.strings)
              file.explode(attachments).scan.strings.strings regex_match ".*oleObject.*mhtml.*http.*"
            file.explode(attachments[])[].flavors.mime eq "text/xml"
         macro "attachments[].file_extension in file_extensions_common_archives"
      and
        or
          and
            attachments.content_type eq "application/octet-stream"
            attachments.file_extension is_null
            attachments.file_type eq "unknown"
            attachments.size lt "100000000"
          attachments.file_extension eq "rtf"
           macro "attachments[].file_extension in file_extensions_macros"
        any(file.oletools(attachments).relationships)
          file.oletools(attachments).relationships.target regex_match ".*html:http.*"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`

Attachment: CVE-2025-24071 - Microsoft Windows File Explorer Spoofing Vulnerability

Severity: critical
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects a Windows library file (.library-ms) containing a network path, either as a direct attachment or within an archive. This file type can be used to cause Windows to send NTLM hash to malicious network locations.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	Scripting, Macros, Exploit

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

attachments
type

Rule body

type.inbound
and any(attachments,
        // handle directly attached files first
        (
          .file_extension == "library-ms"
          // and contains a url with the \\
          and strings.icontains(file.parse_text(.).text, '<url>\\')
        )
        // handle library-ms files inside of archives
        or (
          .file_extension in $file_extensions_common_archives
          and any(file.explode(.),
                  // the exploded archive contained a file with the library-ms extension
                  .file_extension == "library-ms"
                  // and the strings in that file contain the required url variable
                  and any(.scan.strings.strings, strings.contains(., '<url>\\'))
          )
        )
)

Detection logic

Scope: inbound message.

inbound message
any of attachments where any holds:
- all of:
  - .file_extension is 'library-ms'
  - file.parse_text(.).text contains '<url>\\\\'
- all of:
  - .file_extension in $file_extensions_common_archives
  - any of file.explode(.) where all hold:
    
    .file_extension is 'library-ms'
    any of .scan.strings.strings where:
    
    . contains '<url>\\\\'

Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode, file.parse_text, strings.contains, strings.icontains. Reference lists: $file_extensions_common_archives.

Indicators matched (4)

Field	Match	Value
`attachments[].file_extension`	equals	`library-ms`
`strings.icontains`	substring	`<url>\\`
`file.explode(attachments[])[].file_extension`	equals	`library-ms`
`strings.contains`	substring	`<url>\\`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(attachments)
    or
      and
        any(file.explode(attachments))
          and
            any(file.explode(attachments).scan.strings.strings)
              file.explode(attachments).scan.strings.strings contains "<url>\\\\"
            file.explode(attachments[])[].file_extension eq "library-ms"
         macro "attachments[].file_extension in file_extensions_common_archives"
      and
        attachments.file_extension eq "library-ms"
        file.parse_text(attachments[]).text contains "<url>\\\\"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`

Sublime MQL rules: cve

Attachment: CVE-2021-40444 - MSHTML Remote Code Execution Vulnerability

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (6)

Stages and Predicates

Stage 1: mql_rule

Indicators

Attachment: CVE-2025-24071 - Microsoft Windows File Explorer Spoofing Vulnerability

Threat classification

Telemetry coverage

Message attributes

Rule body

Detection logic

Indicators matched (4)

Stages and Predicates

Stage 1: mql_rule

Indicators

Stage 1: `mql_rule`

Stage 1: `mql_rule`