Attachment: File execution via Javascript

name: "Attachment: File execution via Javascript"
description: |
  Javascript contains identifiers or strings that may attempt to execute files.
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(attachments,
          .file_type in $file_extensions_common_archives
          and any(file.explode(.),
                  any(.scan.javascript.identifiers,
                      strings.ilike(., 'ActiveXObject', 'ShellExecute')
                  )
                  or (
                    length(.scan.javascript.strings) > 0
                    and all(.scan.javascript.strings,
                            strings.ilike(., 'Shell.Application', '*.exe')
                    )
                  )
          )
  )
  and (
    profile.by_sender().prevalence in ("new", "outlier")
    or profile.by_sender().any_messages_malicious_or_spam
  )
  and not profile.by_sender().any_messages_benign
tags:
  - "Attack surface reduction"
attack_types:
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Evasion"
  - "Scripting"
detection_methods:
  - "Archive analysis"
  - "File analysis"
  - "Javascript analysis"
  - "Sender analysis"
id: "627ae0b1-fbe7-58cf-ba7d-0cf51b806c8a"