Detection rules › Sublime MQL
Inline image as message with attachment or link
Using inline images in lieu of HTML or text content in the message is a known technique used to bypass content based scanning engines. We've observed this technique used to deliver malware via attachments and phish credentials.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion, Image as content |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| body |
| body.html |
| body.links (collection) |
| type |
Rule body MQL
type.inbound
and length(body.html.raw) < 200
and length(body.links) > 0
and (
// as of 20220116 there's a link parsing bug with .png inline images, so ignore those
any(body.links, not strings.ilike(.href_url.url, "*.png"))
// cid images are treated as attachments, so we're looking for more than 1
or (
length(attachments) > 1
and any(attachments, .file_type not in $file_types_images)
)
)
and strings.ilike(body.html.raw, "*img*cid*")
and (
profile.by_sender().prevalence in ("new", "outlier")
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
Detection logic
Scope: inbound message.
Using inline images in lieu of HTML or text content in the message is a known technique used to bypass content based scanning engines. We've observed this technique used to deliver malware via attachments and phish credentials.
- inbound message
- length(body.html.raw) < 200
- length(body.links) > 0
any of:
any of
body.linkswhere:not:
- .href_url.url matches '*.png'
all of:
- length(attachments) > 1
any of
attachmentswhere:- .file_type not in $file_types_images
- body.html.raw matches '*img*cid*'
any of:
- profile.by_sender().prevalence in ('new', 'outlier')
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
Inspects: attachments[].file_type, body.html.raw, body.links, body.links[].href_url.url, type.inbound. Sensors: profile.by_sender, strings.ilike. Reference lists: $file_types_images.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
strings.ilike | substring | *.png |
strings.ilike | substring | *img*cid* |