sublimemediumRule

Attachment: Malformed mobileconfig file

Detects inbound emails containing .mobileconfig attachments that are missing required Apple configuration profile keys such as PayloadType, PayloadVersion, PayloadIdentifier, and PayloadUUID. The absence of these mandatory fields indicates the file does not conform to the standard Apple configuration profile schema, suggesting it may be malformed, tampered with, or crafted for malicious purposes such as unauthorized device configuration changes.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(attachments,
        .file_extension == "mobileconfig"
        and not strings.icontains(file.parse_text(.).text,
                                  '<key>PayloadType</key>',
                                  '<key>PayloadVersion</key>',
                                  '<key>PayloadIdentifier</key>',
                                  '<key>PayloadUUID</key>'
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: Malformed mobileconfig file"
description: "Detects inbound emails containing .mobileconfig attachments that are missing required Apple configuration profile keys such as PayloadType, PayloadVersion, PayloadIdentifier, and PayloadUUID. The absence of these mandatory fields indicates the file does not conform to the standard Apple configuration profile schema, suggesting it may be malformed, tampered with, or crafted for malicious purposes such as unauthorized device configuration changes."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(attachments,
          .file_extension == "mobileconfig"
          and not strings.icontains(file.parse_text(.).text,
                                    '<key>PayloadType</key>',
                                    '<key>PayloadVersion</key>',
                                    '<key>PayloadIdentifier</key>',
                                    '<key>PayloadUUID</key>'
          )
  )
  
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Evasion"
detection_methods:
  - "File analysis"
  - "XML analysis"
id: "bd0b79fa-c43d-539b-baba-0ba5806cd59a"