• Sublime Core Feed
Low Severity

Attachment: cmd file extension

Labels

Malware/Ransomware
Scripting
Archive analysis
File analysis

Description

Detects messages containing CMD (Command Prompt) batch files, either as direct attachments or within compressed archives. CMD files can execute arbitrary system commands and are commonly used to deliver malware or perform unauthorized system modifications.

References

No references.

Sublime Security
Created Feb 9th, 2026 • Last updated Feb 9th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and length(attachments) > 0
and any(attachments,
        .file_extension =~ "cmd"
        or (
          .file_extension in~ $file_extensions_common_archives
          and any(file.explode(.), .file_extension =~ "cmd")
        )
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started