Detection rules › Sublime MQL
Attachment: CVE-2025-24071 - Microsoft Windows File Explorer Spoofing Vulnerability
Detects a Windows library file (.library-ms) containing a network path, either as a direct attachment or within an archive. This file type can be used to cause Windows to send NTLM hash to malicious network locations.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Scripting, Macros, Exploit |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
// handle directly attached files first
(
.file_extension == "library-ms"
// and contains a url with the \\
and strings.icontains(file.parse_text(.).text, '<url>\\')
)
// handle library-ms files inside of archives
or (
.file_extension in $file_extensions_common_archives
and any(file.explode(.),
// the exploded archive contained a file with the library-ms extension
.file_extension == "library-ms"
// and the strings in that file contain the required url variable
and any(.scan.strings.strings, strings.contains(., '<url>\\'))
)
)
)
Detection logic
Scope: inbound message.
Detects a Windows library file (.library-ms) containing a network path, either as a direct attachment or within an archive. This file type can be used to cause Windows to send NTLM hash to malicious network locations.
- inbound message
any of
attachmentswhere any holds:all of:
- .file_extension is 'library-ms'
- file.parse_text(.).text contains '<url>\\\\'
all of:
- .file_extension in $file_extensions_common_archives
any of
file.explode(.)where all hold:- .file_extension is 'library-ms'
any of
.scan.strings.stringswhere:- . contains '<url>\\\\'
Inspects: attachments[].file_extension, type.inbound. Sensors: file.explode, file.parse_text, strings.contains, strings.icontains. Reference lists: $file_extensions_common_archives.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | equals | library-ms |
strings.icontains | substring | <url>\\ |
file.explode(attachments[])[].file_extension | equals | library-ms |
strings.contains | substring | <url>\\ |