Attachment: Malicious mobileconfig profile

calendar Sep 29, 2026  ·
Share on: linkedin copy

Detects inbound emails containing .mobileconfig attachments that either reference a known malicious profile UUID string within their parsed text or match a list of known malicious SHA256 hashes. These crafted files are used as a lure to trick recipients into installing a bogus update, often paired with payment or account-themed subject lines and disposable or spoofed sender domains.

Sublime rule (View on GitHub)

 1name: "Attachment: Malicious mobileconfig profile"
 2description: "Detects inbound emails containing .mobileconfig attachments that either reference a known malicious profile UUID string within their parsed text or match a list of known malicious SHA256 hashes. These crafted files are used as a lure to trick recipients into installing a bogus update, often paired with payment or account-themed subject lines and disposable or spoofed sender domains."
 3type: "rule"
 4severity: "medium"
 5source: |
 6    type.inbound
 7    and any(attachments,
 8            .file_extension == "mobileconfig"
 9            and (
10              strings.icontains(file.parse_text(.).text,
11                                '10a30957-e16b-30bf-c00f-48e1e9a85069'
12              )
13              or .sha256 in (
14                '783cdb7425fbc29f5e35801d38a4782040da7f50e74d78de4b56eaa532eda82a',
15                'ee8f15128560c2b2b4ee242026b2a2880ee604fe8489abb999ac43c969cfcdce',
16                '8c0013f6ee4fe229f567469ed3f1bdaf2ee6a7a4b39a04ed28df38fa25287dfb'
17              )
18            )
19    )    
20  
21attack_types:
22  - "Credential Phishing"
23tactics_and_techniques:
24  - "Social engineering"
25detection_methods:
26  - "File analysis"
27  - "Content analysis"
28  - "Threat intelligence"
29id: "447bce8d-dc96-5110-9aeb-9434fcffc717"
to-top