sublimehighRule

MalwareBazaar: Malicious attachment hash in archive (trusted reporters)

Detects if an arhive attachments contains a file that matches a SHA256 hash reported as malware on MalwareBazaar by trusted reporters from unknown senders.

MITRE ATT&CK

T1566.001 T1204.002 T1486 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(attachments,
        .file_extension in~ $file_extensions_common_archives
        and any(file.explode(.),
                .scan.hash.sha256 in $abuse_ch_malwarebazaar_sha256_trusted_reporters
        )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and not profile.by_sender().any_messages_benign

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "MalwareBazaar: Malicious attachment hash in archive (trusted reporters)"
description: "Detects if an arhive attachments contains a file that matches a SHA256 hash reported as malware on MalwareBazaar by trusted reporters from unknown senders."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(attachments,
          .file_extension in~ $file_extensions_common_archives
          and any(file.explode(.),
                  .scan.hash.sha256 in $abuse_ch_malwarebazaar_sha256_trusted_reporters
          )
  )
  and (
    not profile.by_sender().solicited
    or (
      profile.by_sender().any_messages_malicious_or_spam
      and not profile.by_sender().any_messages_benign
    )
  )
  and not profile.by_sender().any_messages_benign
  

attack_types:
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Evasion"
detection_methods:
  - "Archive analysis"
  - "File analysis"
  - "Sender analysis"
  - "Threat intelligence"
id: "9d734281-3111-5bed-a192-9ae0e1ad6b9d"