Detect Shebang File Types Received Via Email
Query
let ShebangFiles = DeviceFileEvents | extend AF=parse_json(AdditionalFields) | where tostring(AF.FileType) == "Shebang" and isnotempty(SHA256)
| project FileTimestamp=Timestamp, DeviceId, DeviceName, FileName, FolderPath, SHA256, FileActionType=ActionType, FileInitiatingProcess=InitiatingProcessFileName, FileInitiatingCommandLine=InitiatingProcessCommandLine, FileType=tostring(AF.FileType);
ShebangFiles
| join kind=inner EmailAttachmentInfo on $left.SHA256 == $right.SHA256About this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1566.001 | Phishing: Spearphishing Attachment |
Author: Sergio Albea (11/06/2026)
Detect Shebang File Types received via Email
Description: Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
Explanation
This query is designed to detect and analyze files with a "shebang" (#!) received via email. Here's a simplified breakdown of what the query does:
-
Context:
- Shebangs are used in scripts on Unix-like systems to specify the interpreter for executing the script. They are not native to Windows but can be used with certain tools and environments.
-
Objective:
- The goal is to identify files with a shebang that have been received as email attachments. This is relevant because such files might be used in phishing attacks, specifically spearphishing with attachments (as per MITRE ATT&CK Technique T1566.001).
-
Query Steps:
- Extract Shebang Files: The query starts by looking at device file events to find files classified as "Shebang" and ensures they have a SHA256 hash value.
- Project Relevant Information: It selects important details about these files, such as the timestamp, device information, file name, folder path, SHA256 hash, action type, and initiating process details.
- Join with Email Data: It then joins this information with email attachment data to find matches based on the SHA256 hash. This step links the shebang files to their corresponding email attachments.
-
Outcome:
- The result is a dataset of shebang files that were received via email, providing insights into potentially suspicious or malicious activity involving script files sent as email attachments.
