detection.wiki

← Sublime email telemetry sources

Sublime-Message-attachments

1 attribute group in the attachments section of the Sublime Message Data Model. Each is addressed by its dotted attribute path, not a numbered event.

Attribute groupDescription
attachments (collection)Message Data Model attribute: attachments

attachments (collection)

#
Section
Sublime-Message-attachments

Description

Message Data Model attribute: attachments

Fields #

NameDescription
content_idContent-ID extracted from the MIME payload; is stripped of leading and trailing <> characters
content_typeContent-Type extracted from the MIME payload
file_extensionFile extension from context such as headers
file_nameFile name
file_typeFile type determined by looking at the magic bytes in the file
md5MD5 hash of the raw contents
sha1SHA1 hash of the raw contents
sha256SHA256 hash of the raw contents
sizeSize of the file in bytes

Detection Rules #

View all rules referencing this event →

Sublime MQL #

Show 17 more (364 total)
  • Attachment: Any HTML file within archive (unsolicited) source medium: Recursively scans archives to detect HTML files from unsolicited senders. HTML files can be used for HTML smuggling and embedded in archives to evade detection.
  • Attachment: Any HTML file (untrusted sender) source medium: Potential HTML smuggling attacks from new senders. Use if passing HTML files is not normal behavior in your environment. This rule may be expanded to inspect HTML attachments for suspicious code.
  • Attachment: Any HTML file (unsolicited) source low: Potential HTML smuggling attacks in unsolicited messages. Use if passing HTML files is not normal behavior in your environment. This rule may be expanded to inspect HTML attachments for suspicious code.
  • Attachment: Any .sap file (unsolicited) source low: SAP shortcut files can be abused to run unsanctioned code on endpoints. Use if receiving .sap files is not normal behavior in your environment.
  • Attachment: Archive containing HTML file with file scheme link source high: Attached archive contains an HTML file with a file:// link, likely pointing to an SMB server. This technique can be used to steal NTLM hashes of users who open the HTML file. Known technique of TA577.
  • Attachment: Archive with embedded CHM file source medium: Recursively scans files and archives to detect embedded CHM (Microsoft Compiled HTML Help) files. According to CERT-UA, on March 7, 2022, phishing attacks targeted state organizations of Ukraine using Zip files with embedded CHM documents, which themselves contained malicious VBScript inside a .htm file. The activity is associated with UNC1151, according to CERT-UA.
  • Attachment: Archive with embedded EXE file source high: Recursively scans files and archives to detect embedded EXE files (with an MZ header). According to The Record, on June 7, 2021, the Ukrainian Secret Service attributed an attack that used this technique to the "special services of the Russian Federation". The spear-phishing operation urged recipients to download a RAR archive included in the email, which, when decompressed, would drop an EXE file with a double extension (filename.pdf.exe) that tried to pass as a PDF file.
  • Attachment: Archive with pdf, txt and wsf files source medium: Detects a known Qakbot delivery method, zip file with pdf, txt and wsf file at a depth of 1
  • Attachment: Base64 encoded bash command in filename source high: This rule detects a fileless attack technique where a malicious payload is encoded directly into a filename. This technique is used by threats like VShell. The rule is designed to find these malicious filenames both in direct attachments and within archived files (like .zip, .rar, etc.).
  • Attachment: Callback phishing solicitation via text-based file source medium: Callback Phishing via a text-based file attachment and a short body and subject from an unknown sender.
  • Attachment: Callback phishing solicitation via image file source high: A fraudulent invoice/receipt found in an image attachment. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.
  • Attachment: Callback phishing solicitation via pdf file source high: A fraudulent invoice/receipt found in a pdf attachment. Callback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. The resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.
  • Attachment: cmd file extension source low: Detects messages containing CMD (Command Prompt) batch files, either as direct attachments or within compressed archives. CMD files can execute arbitrary system commands and are commonly used to deliver malware or perform unauthorized system modifications.
  • Credential phishing: Image as content, short or no body contents source medium: This rule identifies incoming messages with minimal links, all image attachments and either empty, brief or the body text is only a warning banner/disclaimer. It also checks for truncated PNG images or logos in addition to high-confidence credit theft intentions.
  • Attachment: CVE-2023-21716 - Microsoft Office Remote Code Execution Vulnerability source high: Attachment contains an RTF file with a font table defining an excessive number of fonts, used to exploit CVE-2023-21716.
  • Attachment: Zip exploiting CVE-2023-38831 (unsolicited) source critical: A Zip attachment that exhibits attributes required to exploit CVE-2023-38831, a vulnerability in WinRAR (prior to 6.23).
  • Attachment: Archive containing disallowed file type source low: Recursively scans archives to detect disallowed file types. File extensions can be detected within password-protected archives. Attackers often embed malicious files within archives to bypass email gateway controls.

References #