• Sublime Core Feed
Medium Severity

Attachment with auto-opening VBA macro (unsolicited)

Labels

Malware/Ransomware
Macros
Archive analysis
File analysis
Macro analysis
Sender analysis

Description

Recursively scans files and archives to detect embedded VBA files with an auto open exec.

References

Sublime Security
Created Aug 17th, 2023 • Last updated Jul 16th, 2025
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(attachments,
        (
          .file_extension in~ $file_extensions_macros
          or .file_extension in~ $file_extensions_common_archives
          or (
              .file_extension is null
              and .file_type == "unknown"
              and .content_type == "application/octet-stream"
              and .size < 100000000
            )
        )
        and any(file.explode(.), any(.scan.vba.auto_exec, . == "AutoOpen"))
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started