• Sublime Core Feed
High Severity

Attachment: .csproj with suspicious commands

Labels

Malware/Ransomware
Evasion
Scripting
File analysis

Description

Attached .csproj file contains suspicious commands.

References

Sublime Security
Created Aug 17th, 2023 • Last updated Aug 17th, 2023
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(attachments,
        .file_extension == "csproj"
        and any(file.explode(.),
                (
                  (any(.scan.strings.strings, strings.contains(., 'DllImport')))
                  and (any(.scan.strings.strings, strings.icontains(., 'CreateProcess')))
                )
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started