High Severity
Attachment: Potential Sandbox Evasion in Office File
Description
Scans attached files with known Office file extension, and alerts on the presence of strings indicative of sandbox evasion checks.
Malicious code may carry out checks against the local host (e.g. running processes, disk size, domain-joined status) before running its final payload.
References
type.inbound
and any(attachments,
(
.file_extension in~ $file_extensions_macros
or (
.file_extension is null
and .file_type == "unknown"
and .content_type == "application/octet-stream"
and .size < 100000000
)
)
and any(file.explode(.),
1 of (
any(.scan.strings.strings, strings.ilike(., "*Win32_Processor*")),
any(.scan.strings.strings, strings.ilike(., "*Win32_LogicalDisk*")),
any(.scan.strings.strings, strings.ilike(., "*Win32_ComputerSystem*")),
any(.scan.strings.strings, strings.ilike(., "*Win32_Process*")),
any(.scan.strings.strings, strings.ilike(., "*LDAP://RootDSE*"))
)
)
)
Playground
Test against your own EMLs or sample data.