Attachment: Encrypted Microsoft Office file (unsolicited)

calendar Dec 19, 2023 · Attack surface reduction  ·
Share on: linkedin copy

Encrypted OLE2 (eg Microsoft Office) attachment from an unsolicited sender. Attachment encryption is a common technique used to bypass malware scanning products. Use if receiving encrypted attachments is not normal behavior in your environment.

Sublime rule (View on GitHub)

 1name: "Attachment: Encrypted Microsoft Office file (unsolicited)"
 2description: |
 3  Encrypted OLE2 (eg Microsoft Office) attachment from an unsolicited sender. Attachment encryption is a common technique used to bypass malware scanning products.
 4  Use if receiving encrypted attachments is not normal behavior in your environment.  
 5references:
 6  - "https://www.cyren.com/blog/articles/anatomy-of-an-attack-password-protected-files-attached-to-emails"
 7type: "rule"
 8severity: "medium"
 9source: |
10  type.inbound
11  and any(attachments,
12          (
13            .file_extension in~ $file_extensions_macros
14            or (
15                .file_extension is null
16                and .file_type == "unknown"
17                and .content_type == "application/octet-stream"
18                and .size < 100000000
19            )
20          )
21          and file.oletools(.).indicators.encryption.exists
22  )
23  and (
24    not profile.by_sender().solicited
25    or (
26      profile.by_sender().any_messages_malicious_or_spam
27      and not profile.by_sender().any_false_positives
28    )
29  )  
30tags:
31  - "Attack surface reduction"
32attack_types:
33  - "Malware/Ransomware"
34tactics_and_techniques:
35  - "Encryption"
36  - "Macros"
37  - "Scripting"
38detection_methods:
39  - "Archive analysis"
40  - "File analysis"
41  - "OLE analysis"
42  - "Sender analysis"
43id: "1e47e953-576c-5ba9-b84e-b72a1a89de87"

Related rules

to-top