← Back to SOC feed Coverage →

Rule to detect the no presence of any attachment

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-05-09T23:00:01Z · Confidence: medium

Hunt Hypothesis

The hypothesis is that the absence of attachments in email communications may indicate an adversary attempting to bypass traditional attachment-based detection mechanisms. A SOC team should proactively hunt for this behavior in Azure Sentinel to identify potential evasion tactics and uncover hidden malicious payloads that may be embedded in other message components.

YARA Rule

rule without_attachments : mail {
	meta:
		author = "Antonio Sanchez <[email protected]>"
		reference = "http://laboratorio.blogs.hispasec.com/"
		description = "Rule to detect the no presence of any attachment"
	strings:
                $eml_01 = "From:"
                $eml_02 = "To:"
                $eml_03 = "Subject:"
		$attachment_id = "X-Attachment-Id"
                $mime_type = "Content-Type: multipart/mixed"
	condition:
                all of ( $eml_* ) and
		not $attachment_id and 
                not $mime_type
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 5 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/email/attachment.yar