Detection rules › Sublime MQL
URI protocol handler: search-ms
Detects HTML attachments using the search-ms URI protocol handler, a technique observed ITW to deliver malicious payloads. This rule can be updated to analyze links in PDF attachments and message bodies
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
.file_type == "html"
and any(file.explode(.),
any(.scan.strings.strings,
regex.contains(., 'search-ms:query.*location:\\\\')
)
)
)
Detection logic
Scope: inbound message.
Detects HTML attachments using the search-ms URI protocol handler, a technique observed ITW to deliver malicious payloads. This rule can be updated to analyze links in PDF attachments and message bodies
- inbound message
any of
attachmentswhere all hold:- .file_type is 'html'
any of
file.explode(.)where:any of
.scan.strings.stringswhere:- . matches 'search-ms:query.*location:\\\\\\\\'
Inspects: attachments[].file_type, type.inbound. Sensors: file.explode, regex.contains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | html |
regex.contains | regex | search-ms:query.*location:\\\\ |