Attachment: Malformed mobileconfig file

calendar Sep 29, 2026  ·
Share on: linkedin copy

Detects inbound emails containing .mobileconfig attachments that are missing required Apple configuration profile keys such as PayloadType, PayloadVersion, PayloadIdentifier, and PayloadUUID. The absence of these mandatory fields indicates the file does not conform to the standard Apple configuration profile schema, suggesting it may be malformed, tampered with, or crafted for malicious purposes such as unauthorized device configuration changes.

Sublime rule (View on GitHub)

 1name: "Attachment: Malformed mobileconfig file"
 2description: "Detects inbound emails containing .mobileconfig attachments that are missing required Apple configuration profile keys such as PayloadType, PayloadVersion, PayloadIdentifier, and PayloadUUID. The absence of these mandatory fields indicates the file does not conform to the standard Apple configuration profile schema, suggesting it may be malformed, tampered with, or crafted for malicious purposes such as unauthorized device configuration changes."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          .file_extension == "mobileconfig"
 9          and not strings.icontains(file.parse_text(.).text,
10                                    '<key>PayloadType</key>',
11                                    '<key>PayloadVersion</key>',
12                                    '<key>PayloadIdentifier</key>',
13                                    '<key>PayloadUUID</key>'
14          )
15  )
16    
17attack_types:
18  - "Credential Phishing"
19tactics_and_techniques:
20  - "Evasion"
21detection_methods:
22  - "File analysis"
23  - "XML analysis"
24id: "bd0b79fa-c43d-539b-baba-0ba5806cd59a"
to-top