Detection rules › Sublime MQL
Link to auto-downloaded disk image in encrypted zip
A link in the body of the email downloads an encrypted zip that contains a disk image of the format IMG, ISO or VHD. This is a combination of file types used to deliver Qakbot.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Encryption, Evasion, Social engineering |
Event coverage
Rule body MQL
type.inbound
and any(body.links,
any(ml.link_analysis(.).files_downloaded,
any(file.explode(.),
(
any(.flavors.yara, . == "encrypted_zip")
and any(.scan.zip.all_paths,
any([".img", ".iso", ".vhd"],
strings.ends_with(.., .)
)
)
)
)
)
)
and (
profile.by_sender().prevalence in ("new", "outlier")
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
Detection logic
Scope: inbound message.
A link in the body of the email downloads an encrypted zip that contains a disk image of the format IMG, ISO or VHD. This is a combination of file types used to deliver Qakbot.
- inbound message
any of
body.linkswhere:any of
ml.link_analysis(.).files_downloadedwhere:any of
file.explode(.)where all hold:any of
.flavors.yarawhere:- . is 'encrypted_zip'
any of
.scan.zip.all_pathswhere:any of
['.img', '.iso', '.vhd']where:- strings.ends_with(.)
any of:
- profile.by_sender().prevalence in ('new', 'outlier')
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
Inspects: body.links, type.inbound. Sensors: file.explode, ml.link_analysis, profile.by_sender, strings.ends_with.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
file.explode(ml.link_analysis(body.links[]).files_downloaded[])[].flavors.yara[] | equals | encrypted_zip |