Observed IOC: Malicious attachment SHA-256 hashes

calendar Aug 28, 2026  ·
Share on: linkedin copy

Detects inbound messages carrying an attachment whose SHA-256 file hash matches a known malicious file observed by the detection-engineering team. IOC list is automatically managed by the IOC pipeline. NOTE: an attachment SHA-256 is itself a file hash, so the embedded literals are SHA-256 of that file hash (hash-of-hash), consistent with the pipeline's hashing convention.

Sublime rule (View on GitHub)

 1name: "Observed IOC: Malicious attachment SHA-256 hashes"
 2description: "Detects inbound messages carrying an attachment whose SHA-256 file hash matches a known malicious file observed by the detection-engineering team. IOC list is automatically managed by the IOC pipeline. NOTE: an attachment SHA-256 is itself a file hash, so the embedded literals are SHA-256 of that file hash (hash-of-hash), consistent with the pipeline's hashing convention."
 3type: "rule"
 4severity: "high"
 5source: |
 6  // AUTO-GENERATED IOC LIST - DO NOT EDIT MANUALLY
 7  // Managed by automated IOC system
 8  false // no active IOCs - rule is temporarily disabled  
 9attack_types:
10  - "Malware/Ransomware"
11  - "Credential Phishing"
12tactics_and_techniques:
13  - "Social engineering"
14  - "Evasion"
15detection_methods:
16  - "Attachment analysis"
17  - "Content analysis"
18id: "f2a3b4c5-d6e7-4f8a-9b0c-d1e2f3a4b5c6"
to-top