Medium Severity

Attachment: Malformed mobileconfig file

Labels

Credential Phishing
Evasion
File analysis
XML analysis

Description

Detects inbound emails containing .mobileconfig attachments that are missing required Apple configuration profile keys such as PayloadType, PayloadVersion, PayloadIdentifier, and PayloadUUID. The absence of these mandatory fields indicates the file does not conform to the standard Apple configuration profile schema, suggesting it may be malformed, tampered with, or crafted for malicious purposes such as unauthorized device configuration changes.

References

No references.

Sublime Security
Created Sep 29th, 2026 • Last updated Sep 29th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(attachments,
        .file_extension == "mobileconfig"
        and not strings.icontains(file.parse_text(.).text,
                                  '<key>PayloadType</key>',
                                  '<key>PayloadVersion</key>',
                                  '<key>PayloadIdentifier</key>',
                                  '<key>PayloadUUID</key>'
        )
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started