• Sublime Core Feed
Medium Severity

Attachment: SFX archive containing commands

Description

Attachment is an SFX archive that contains commands that will execute when opened. This can be used to run malicious commands, and has been observed in the wild.

Sublime Security
Created Aug 17th, 2023 • Last updated Jan 12th, 2026
Source
type.inbound
and any(attachments,
        .file_extension in~ ("exe", "sfx")
        and any(file.explode(.),
                any(.scan.strings.strings,
                    strings.ilike(.,
                                  'CMT;The comment below contains SFX script commands'
                    )
                )
                and any(.scan.strings.strings, strings.ilike(., 'Setup=*'))
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started