Medium Severity
Attachment: SFX archive containing commands
Description
Attachment is an SFX archive that contains commands that will execute when opened. This can be used to run malicious commands, and has been observed in the wild.
References
Sublime Security
Created Aug 17th, 2023 • Last updated Aug 21st, 2023
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments,
.file_extension in~ ("exe", "sfx")
and any(file.explode(.),
any(.scan.strings.strings,
strings.ilike(., 'CMT;The comment below contains SFX script commands')
)
and any(.scan.strings.strings, strings.ilike(., 'Setup=*'))
)
)
Playground
Test against your own EMLs or sample data.