High Severity
Attachment: Emotet heavily padded doc in zip file
Labels
Description
Detects a potential Emotet delivery method using padded .doc files that compress into small zip files.
Contents may include Red Dawn templates exceeding 500MB.
Sublime Security
Created Aug 17th, 2023 • Last updated Oct 4th, 2023
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments,
.file_extension == "zip"
and any(file.explode(.),
.depth == 0
and .size < 1000000
and not .depth > 0
and strings.ends_with(.scan.exiftool.zip_file_name, ".doc")
and .scan.exiftool.zip_uncompressed_size > 500000000
)
)
and (
profile.by_sender().prevalence in ("new", "outlier")
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_false_positives
)
)
Playground
Test against your own EMLs or sample data.