High Severity
MalwareBazaar: Malicious attachment hash in archive (trusted reporters)
Description
Detects if an arhive attachments contains a file that matches a SHA256 hash reported as malware on MalwareBazaar by trusted reporters from unknown senders.
References
No references.
Sublime Security
Created Dec 20th, 2023 • Last updated Dec 20th, 2023
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments,
.file_extension in~ $file_extensions_common_archives
and any(file.explode(.),
.scan.hash.sha256 in $abuse_ch_malwarebazaar_sha256_trusted_reporters
)
)
and (
not profile.by_sender().solicited
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_false_positives
)
)
and not profile.by_sender().any_false_positives
Playground
Test against your own EMLs or sample data.