Detection rules › Sublime MQL
Service abuse: Citrix ShareFile impersonation via Outlook plugin
Detects inbound messages with Word document attachments containing references to sharefile.com and Outlook plugin system indicators, suggesting abuse of legitimate file sharing services to deliver malicious content.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Free file host, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
.file_type in ("doc", "docx")
and any(file.explode(.),
strings.icontains(.scan.strings.raw, "sharefile.com")
and strings.icontains(.scan.strings.raw,
"src=system-email-outlookplugin-new"
)
)
)
Detection logic
Scope: inbound message.
Detects inbound messages with Word document attachments containing references to sharefile.com and Outlook plugin system indicators, suggesting abuse of legitimate file sharing services to deliver malicious content.
- inbound message
any of
attachmentswhere all hold:- .file_type in ('doc', 'docx')
any of
file.explode(.)where all hold:- .scan.strings.raw contains 'sharefile.com'
- .scan.strings.raw contains 'src=system-email-outlookplugin-new'
Inspects: attachments[].file_type, type.inbound. Sensors: file.explode, strings.icontains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | member | doc |
attachments[].file_type | member | docx |
strings.icontains | substring | sharefile.com |
strings.icontains | substring | src=system-email-outlookplugin-new |