Suspicious VBA macros from untrusted sender

name: "Suspicious VBA macros from untrusted sender"
description: |
  Detects any VBA macro attachment that scores above a medium confidence threshold in the Sublime Macro Classifier.
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(attachments,
          (
            .file_extension in~ $file_extensions_macros
            or (
              .file_extension is null
              and .file_type == "unknown"
              and .content_type == "application/octet-stream"
              and .size < 100000000
            )
          )
          and ml.macro_classifier(.).malicious
          and ml.macro_classifier(.).confidence in ("high")
  )
  and (
    profile.by_sender().prevalence in ("new", "outlier")
    or (
      profile.by_sender().any_messages_malicious_or_spam
      and not profile.by_sender().any_messages_benign
    )
  )
attack_types:
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Macros"
detection_methods:
  - "File analysis"
  - "Macro analysis"
  - "Sender analysis"
id: "37cec120-2757-5e99-a489-1315780dae08"