Detection rules › Sublime MQL
Link to auto-downloaded DMG in archive
A link in the body of the message downloads an archive containing a DMG file. The message is not from a common or trusted sender and is unsolicited.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| body |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and any(body.links,
any(ml.link_analysis(.).files_downloaded,
.file_extension in~ $file_extensions_common_archives
and any(file.explode(.), .file_extension == "dmg")
)
)
and (
(
profile.by_sender().prevalence != "common"
and not profile.by_sender().solicited
)
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_messages_benign
)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
A link in the body of the message downloads an archive containing a DMG file. The message is not from a common or trusted sender and is unsolicited.
- inbound message
any of
body.linkswhere:any of
ml.link_analysis(.).files_downloadedwhere all hold:- .file_extension in $file_extensions_common_archives
any of
file.explode(.)where:- .file_extension is 'dmg'
any of:
all of:
- profile.by_sender().prevalence is not 'common'
not:
- profile.by_sender().solicited
all of:
- profile.by_sender().any_messages_malicious_or_spam
not:
- profile.by_sender().any_messages_benign
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: body.links, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, ml.link_analysis, profile.by_sender. Reference lists: $file_extensions_common_archives, $high_trust_sender_root_domains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
file.explode(ml.link_analysis(body.links[]).files_downloaded[])[].file_extension | equals | dmg |