Attachment: Microsoft SharePoint Impersonation via images in macro-enabled attachment

calendar Jul 16, 2026  ·
Share on: linkedin copy

Detects macro-enabled Office documents (docx and similar extensions) that contain images with text mimicking Microsoft SharePoint file-sharing notifications. The embedded images reference SharePoint collaboration language such as invitations to edit or references to Microsoft 365 access controls, designed to deceive recipients into trusting the attachment.

Sublime rule (View on GitHub)

 1name: "Attachment: Microsoft SharePoint Impersonation via images in macro-enabled attachment"
 2description: "Detects macro-enabled Office documents (docx and similar extensions) that contain images with text mimicking Microsoft SharePoint file-sharing notifications. The embedded images reference SharePoint collaboration language such as invitations to edit or references to Microsoft 365 access controls, designed to deceive recipients into trusting the attachment."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  // office docx
 8  and any(filter(attachments, .file_extension in $file_extensions_macros),
 9          any(file.explode(.),
10              // that contain sharepoint file share email wording in images
11              strings.icontains(.scan.ocr.raw,
12                                ' invited you to edit',
13                                'This invite will only work for you and people with existing access',
14                                ' use of Microsoft 365 and may contain content that is controlled by'
15              )
16          )
17  )  
18attack_types:
19  - "Credential Phishing"
20tactics_and_techniques:
21  - "Impersonation: Brand"
22  - "Macros"
23  - "Image as content"
24  - "Social engineering"
25detection_methods:
26  - "File analysis"
27  - "Macro analysis"
28  - "Optical Character Recognition"
29id: "2c845262-09d5-53ce-939b-99a9a411372d"
to-top