sublimehighRule

Observed IOC: Malicious attachment SHA-256 hashes

Detects inbound messages carrying an attachment whose SHA-256 file hash matches a known malicious file observed by the detection-engineering team. IOC list is automatically managed by the IOC pipeline. NOTE: an attachment SHA-256 is itself a file hash, so the embedded literals are SHA-256 of that file hash (hash-of-hash), consistent with the pipeline's hashing convention.

MITRE ATT&CK

T1566.001 T1204.002 T1486 T1566 T1566.002 T1598 T1036 T1027

initial-accessdefense-evasion

Detection Query

// AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
// Managed by automated IOC system
false // no active IOCs - rule is temporarily disabled

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Observed IOC: Malicious attachment SHA-256 hashes"
description: "Detects inbound messages carrying an attachment whose SHA-256 file hash matches a known malicious file observed by the detection-engineering team. IOC list is automatically managed by the IOC pipeline. NOTE: an attachment SHA-256 is itself a file hash, so the embedded literals are SHA-256 of that file hash (hash-of-hash), consistent with the pipeline's hashing convention."
type: "rule"
severity: "high"
source: |
  // AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
  // Managed by automated IOC system
  false // no active IOCs - rule is temporarily disabled
attack_types:
  - "Malware/Ransomware"
  - "Credential Phishing"
tactics_and_techniques:
  - "Social engineering"
  - "Evasion"
detection_methods:
  - "Attachment analysis"
  - "Content analysis"
id: "f2a3b4c5-d6e7-4f8a-9b0c-d1e2f3a4b5c6"