Detection rules › Sublime MQL

Sublime MQL rules: macos

Rule	Severity
macOS malware: Compiled AppleScript with document double-extension	`high`

macOS malware: Compiled AppleScript with document double-extension

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects compiled AppleScript files (.scpt) with document double-extensions (e.g., .docx.scpt, .pdf.scpt) commonly used in DPRK-attributed macOS malware campaigns. These files open in Script Editor when double-clicked and use social engineering (fake compatibility errors) to trick users into executing malicious reconnaissance scripts that fetch subsequent payload stages.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Malware/Ransomware
Tactics and techniques	Evasion, Social engineering

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

attachments
headers
headers.auth_summary
sender.email
type

Rule body

type.inbound

// attachment with .scpt extension (compiled AppleScript)
and any(attachments,
        .file_extension == "scpt"
        // double extension pattern: common document extensions followed by .scpt
        and regex.icontains(.file_name,
                            '\.(doc|docx|pdf|xls|xlsx|ppt|pptx|txt|rtf)\.scpt$'
        )
        // ensure it's actually a binary/script file, not just renamed
        // compiled AppleScript files are binary and have minimum size
        and (.file_type == "unknown" or .file_type == "exe")
        // compiled .scpt files are binary, should have reasonable size
        and .size > 1000
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Detection logic

Scope: inbound message.

inbound message
any of attachments where all hold:
- .file_extension is 'scpt'
- .file_name matches '\\.(doc|docx|pdf|xls|xlsx|ppt|pptx|txt|rtf)\\.scpt$'
- any of:
  - .file_type is 'unknown'
  - .file_type is 'exe'
- .size > 1000
any of:
- all of:
  - sender.email.domain.root_domain in $high_trust_sender_root_domains
  - not:
    
    headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains

Inspects: attachments[].file_extension, attachments[].file_name, attachments[].file_type, attachments[].size, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: regex.icontains. Reference lists: $high_trust_sender_root_domains.

Indicators matched (4)

Field	Match	Value
`attachments[].file_extension`	equals	`scpt`
`regex.icontains`	regex	`\.(doc\|docx\|pdf\|xls\|xlsx\|ppt\|pptx\|txt\|rtf)\.scpt$`
`attachments[].file_type`	equals	`unknown`
`attachments[].file_type`	equals	`exe`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(attachments)
    and
      or
        attachments.file_type eq "exe"
        attachments.file_type eq "unknown"
      attachments.file_extension eq "scpt"
      attachments.file_name regex_match "\\.(doc|docx|pdf|xls|xlsx|ppt|pptx|txt|rtf)\\.scpt$"
      attachments.size gt "1000"
  or
    and
      not
        headers.auth_summary.dmarc.pass eq "true"
       macro "sender.email.domain.root_domain in high_trust_sender_root_domains"
     macro "sender.email.domain.root_domain not in high_trust_sender_root_domains"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`