New Rule: Malware Bazaar hash in archive (#1160)

Co-authored-by: ID Generator <[email protected]>
Co-authored-by: Josh Kamdjou <[email protected]>

detection-rules/attachment_malwarebazaar_hash_in_archive.yml

@@ -0,0 +1,32 @@
+name: "MalwareBazaar: Malicious attachment hash in archive (trusted reporters)"
+description: "Detects if an arhive attachments contains a file that matches a SHA256 hash reported as malware on MalwareBazaar by trusted reporters from unknown senders."
+type: "rule"
+severity: "high"
+source: |
+  type.inbound
+  and any(attachments,
+          .file_extension in~ $file_extensions_common_archives
+          and any(file.explode(.),
+                  .scan.hash.sha256 in $abuse_ch_malwarebazaar_sha256_trusted_reporters
+          )
+  )
+  and (
+    not profile.by_sender().solicited
+    or (
+      profile.by_sender().any_messages_malicious_or_spam
+      and not profile.by_sender().any_false_positives
+    )
+  )
+  and not profile.by_sender().any_false_positives
+  
+
+attack_types:
+  - "Malware/Ransomware"
+tactics_and_techniques:
+  - "Evasion"
+detection_methods:
+  - "Archive analysis"
+  - "File analysis"
+  - "Sender analysis"
+  - "Threat intelligence"
+id: "9d734281-3111-5bed-a192-9ae0e1ad6b9d"