Detection rules › Sublime MQL
macOS malware: Compiled AppleScript with document double-extension
Detects compiled AppleScript files (.scpt) with document double-extensions (e.g., .docx.scpt, .pdf.scpt) commonly used in DPRK-attributed macOS malware campaigns. These files open in Script Editor when double-clicked and use social engineering (fake compatibility errors) to trick users into executing malicious reconnaissance scripts that fetch subsequent payload stages.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
// attachment with .scpt extension (compiled AppleScript)
and any(attachments,
.file_extension == "scpt"
// double extension pattern: common document extensions followed by .scpt
and regex.icontains(.file_name,
'\.(doc|docx|pdf|xls|xlsx|ppt|pptx|txt|rtf)\.scpt$'
)
// ensure it's actually a binary/script file, not just renamed
// compiled AppleScript files are binary and have minimum size
and (.file_type == "unknown" or .file_type == "exe")
// compiled .scpt files are binary, should have reasonable size
and .size > 1000
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Detects compiled AppleScript files (.scpt) with document double-extensions (e.g., .docx.scpt, .pdf.scpt) commonly used in DPRK-attributed macOS malware campaigns. These files open in Script Editor when double-clicked and use social engineering (fake compatibility errors) to trick users into executing malicious reconnaissance scripts that fetch subsequent payload stages.
- inbound message
any of
attachmentswhere all hold:- .file_extension is 'scpt'
- .file_name matches '\\.(doc|docx|pdf|xls|xlsx|ppt|pptx|txt|rtf)\\.scpt$'
any of:
- .file_type is 'unknown'
- .file_type is 'exe'
- .size > 1000
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: attachments[].file_extension, attachments[].file_name, attachments[].file_type, attachments[].size, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: regex.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | equals | scpt |
regex.icontains | regex | \.(doc|docx|pdf|xls|xlsx|ppt|pptx|txt|rtf)\.scpt$ |
attachments[].file_type | equals | unknown |
attachments[].file_type | equals | exe |