sublimehighRule

Attachment: MS OOXML file created by Administrator with zero edit time

Detects inbound PowerPoint (.pptx) and other MS OOXML attachments where the file creator is listed as 'Administrator' and the total edit time is zero minutes, while missing the 'TitlesOfParts' metadata field. This pattern may indicate programmatically generated or suspicious presentation files.

MITRE ATT&CK

T1566.001 T1204.002 T1486 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(filter(attachments, .file_type in ("pptx", "docx")),
        beta.parse_exif(.).creator == "Administrator"
        and any(beta.parse_exif(.).fields,
                .key == "TotalEditTime" and .value == "0"
        )
        and not 'TitlesOfParts' in map(beta.parse_exif(.).fields, .key)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: MS OOXML file created by Administrator with zero edit time"
description: "Detects inbound PowerPoint (.pptx) and other MS OOXML attachments where the file creator is listed as 'Administrator' and the total edit time is zero minutes, while missing the 'TitlesOfParts' metadata field. This pattern may indicate programmatically generated or suspicious presentation files."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(filter(attachments, .file_type in ("pptx", "docx")),
          beta.parse_exif(.).creator == "Administrator"
          and any(beta.parse_exif(.).fields,
                  .key == "TotalEditTime" and .value == "0"
          )
          and not 'TitlesOfParts' in map(beta.parse_exif(.).fields, .key)
  )
attack_types:
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Evasion"
detection_methods:
  - "Exif analysis"
  - "File analysis"
id: "e6175f24-12b5-52a7-8c76-74ee289a6c82"