• Sublime Core Feed
High Severity

Attachment: Excel Web Query File (IQY)

Labels

Credential Phishing
Malware/Ransomware
Evasion
Archive analysis
File analysis

Description

Recursively scans files and archives to detect IQY files.

Coercing a target user into providing credentials to an attacker-controlled web server, or for SMB relaying.

References

@jkcoote
Created Aug 17th, 2023 • Last updated Aug 21st, 2023
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and (
  any(attachments, .file_extension =~ "iqy")
  or (
    any(attachments,
        .file_extension in~ $file_extensions_common_archives
        and any(file.explode(.), .file_extension =~ "iqy")
    )
  )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started