Detection rules › By event

Sublime-Message-attachments

Event	Rules
attachments (collection)	392

attachments (collection)

392 detection rules reference this event. View event page.

Sublime MQL (392)

Adobe branded PDF file linking to a password-protected file from untrusted sender severity high
Attachment soliciting user to enable macros severity high
Attachment with auto-executing macro (unsolicited) severity medium
Attachment with auto-opening VBA macro (unsolicited) severity medium
Attachment with encrypted zip (unsolicited) severity medium
Attachment with high risk VBA macro (unsolicited) severity high
Attachment with macro calling executable severity high
Attachment with suspicious author (unsolicited) severity high
Attachment with unscannable encrypted zip severity medium
Attachment with VBA macros from employee impersonation (unsolicited) severity high
Attachment: .csproj with suspicious commands severity high
Attachment: 7z Archive Containing RAR File severity medium
Attachment: Adobe image lure in body or attachment with suspicious link severity medium
Attachment: Adobe Sign lure PDF with embedded banner images severity medium
Attachment: Any .sap file (unsolicited) severity low
Attachment: Any HTML file (unsolicited) severity low
Attachment: Any HTML file (untrusted sender) severity medium
Attachment: Any HTML file within archive (unsolicited) severity medium
Attachment: Archive containing disallowed file type severity low
Attachment: Archive containing HTML file with file scheme link severity high
Attachment: Archive contains DLL-loading macro severity high
Attachment: Archive with embedded CHM file severity medium
Attachment: Archive with embedded EXE file severity high
Attachment: Archive with pdf, txt and wsf files severity medium
Attachment: Base64 encoded bash command in filename severity high
Attachment: Calendar file with invisible Unicode characters severity high
Attachment: Calendar invite from recently registered domain severity high
Attachment: Calendar invite with Google redirect and invoice request severity medium
Attachment: Calendar invite with suspicious link leading to an open redirect severity high
Attachment: Callback phishing solicitation via image file severity high
Attachment: Callback phishing solicitation via pdf file severity high
Attachment: Callback phishing solicitation via text-based file severity medium
Attachment: Canva PDF with susupicious author metadata severity high
Attachment: cmd file extension severity low
Attachment: Cold outreach with invitation subject and not attachment severity high
Attachment: Compensation review lure with QR code severity high
Attachment: Compensation-themed DOCX with QR code credential theft severity high
Attachment: CVE-2021-40444 - MSHTML Remote Code Execution Vulnerability severity critical
Attachment: CVE-2023-21716 - Microsoft Office Remote Code Execution Vulnerability severity high
Attachment: CVE-2025-24071 - Microsoft Windows File Explorer Spoofing Vulnerability severity critical
Attachment: Decoy PDF author (Julie P.) severity high
Attachment: DocuSign impersonation via PDF linking to new domain severity medium
Attachment: DocX embedded binary severity high
Attachment: DOCX with hyperlink targeting recipient address severity medium
Attachment: DOCX with malicious document template artifacts severity medium
Attachment: Double base64-encoded zip file in HTML smuggling attachment severity high
Attachment: Dropbox image lure with no Dropbox domains in links severity medium
Attachment: Duplicated header pages in fraudulent multi-page PDF Request for Quotation severity medium
Attachment: EICAR string present severity low
Attachment: Embedded Javascript in SVG file severity high
Attachment: Embedded VBScript in MHT file severity medium
Attachment: EML containing a base64 encoded script severity high
Attachment: EML file contains HTML attachment with login portal indicators severity high
Attachment: EML file with HTML attachment (unsolicited) severity medium
Attachment: EML file with IPFS links severity medium
Attachment: EML with embedded Javascript in SVG file severity high
Attachment: EML with Encrypted ZIP severity low
Attachment: EML with link to credential phishing page severity high
Attachment: EML with SharePoint files shared from GoDaddy federated tenants severity low
Attachment: EML with Sharepoint link likely unrelated to sender severity medium
Attachment: EML with suspicious indicators severity medium
Attachment: Emotet heavily padded doc in zip file severity high
Attachment: Employment contract update with suspicious file naming severity high
Attachment: Encrypted Microsoft Office file (unsolicited) severity medium
Attachment: Encrypted PDF With Credential Harvesting Indicators severity medium
Attachment: Encrypted PDF with credential theft body severity medium
Attachment: Encrypted ZIP containing VHDX file severity medium
Attachment: Encrypted zip file with payment-related lure severity medium
Attachment: Excel file with document sharing lure created by Go Excelize severity high
Attachment: Excel file with suspicious template identifier severity high
Attachment: Excel Web Query File (IQY) severity high
Attachment: Fake attachment image lure severity medium
Attachment: Fake PDF Invoices Yara severity medium
Attachment: Fake scan-to-email severity medium
Attachment: Fake Slack installer severity high
Attachment: Fake voicemail via PDF severity medium
Attachment: Fake Zoom installer severity high
Attachment: Fictitious invoice using LinkedIn's address severity medium
Attachment: File execution via Javascript severity medium
Attachment: Filename containing Unicode braille pattern blank character severity high
Attachment: Filename containing Unicode right-to-left override character severity high
Attachment: Finance themed PDF with observed phishing template severity medium
Attachment: HTML attachment with Javascript location severity high
Attachment: HTML attachment with login portal indicators severity medium
Attachment: HTML file contains exclusively Javascript severity medium
Attachment: HTML file with excessive 'const' declarations and abnormally long timeouts severity high
Attachment: HTML file with excessive padding and suspicious patterns severity high
Attachment: HTML file with reference to recipient and suspicious patterns severity high
Attachment: HTML smuggling 'body onload' linking to suspicious destination severity high
Attachment: HTML smuggling 'body onload' with high entropy and suspicious text severity high
Attachment: HTML smuggling - QR Code with suspicious links severity high
Attachment: HTML smuggling Microsoft sign in severity high
Attachment: HTML smuggling with atob and high entropy severity high
Attachment: HTML smuggling with atob and high entropy via calendar invite severity high
Attachment: HTML smuggling with auto-downloaded file severity high
Attachment: HTML smuggling with base64 encoded JavaScript function severity high
Attachment: HTML smuggling with base64 encoded ZIP file severity medium
Attachment: HTML smuggling with concatenation obfuscation severity high
Attachment: HTML smuggling with decimal encoding severity high
Attachment: HTML smuggling with embedded base64 streamed file download severity high
Attachment: HTML smuggling with embedded base64-encoded executable severity high
Attachment: HTML smuggling with embedded base64-encoded ISO severity high
Attachment: HTML smuggling with eval and atob severity high
Attachment: HTML smuggling with eval and atob via calendar invite severity high
Attachment: HTML smuggling with excessive line break obfuscation severity high
Attachment: HTML smuggling with excessive string concatenation and suspicious patterns severity medium
Attachment: HTML smuggling with fromCharCode and other signals severity high
Attachment: HTML smuggling with hex strings severity medium
Attachment: HTML smuggling with high entropy and other signals severity high
Attachment: HTML smuggling with raw array buffer severity high
Attachment: HTML smuggling with RC4 decryption severity high
Attachment: HTML smuggling with ROT13 severity high
Attachment: HTML smuggling with setTimeout severity high
Attachment: HTML smuggling with unescape severity high
Attachment: HTML with emoji-to-character map severity high
Attachment: HTML with hidden body severity high
Attachment: HTML with JavaScript functions for HTTP requests severity high
Attachment: HTML with obfuscation and recipient's email in JavaScript strings severity high
Attachment: ICS calendar file with base64 encoded recipient address in URL parameters severity high
Attachment: ICS calendar file with QR code containing recipient email address severity high
Attachment: ICS calendar file with recipient address in UID field severity high
Attachment: ICS calendar file with suspicious product identifier severity medium
Attachment: ICS calendar file with suspicious UID domain severity medium
Attachment: ICS calendar with embedded file from internal sender with SPF failure severity high
Attachment: ICS file with AWS Lambda URL severity medium
Attachment: ICS file with excessive custom properties severity medium
Attachment: ICS file with links to newly registered domains severity medium
Attachment: ICS file with meeting prefix severity high
Attachment: ICS file with non-Gregorian calendar scale severity medium
Attachment: ICS with embedded document severity low
Attachment: ICS with embedded Javascript in SVG file severity high
Attachment: ICS with employee policy review lure severity high
Attachment: Invoice and W-9 PDFs with suspicious creators severity high
Attachment: JavaScript file with suspicious base64-encoded executable severity high
Attachment: JPEG with gd-jpeg creator and suspicious file name severity high
Attachment: Legal themed message or PDF with suspicious indicators severity medium
Attachment: Link file with UNC path severity medium
Attachment: Link to Doubleclick.net open redirect severity medium
Attachment: LNK file severity high
Attachment: LNK with embedded content severity high
Attachment: Macro files containing MHT content severity medium
Attachment: Macro with suspected use of COM ShellBrowserWindow object for process creation severity high
Attachment: Malformed OLE file severity high
Attachment: Malicious OneNote commands severity high
Attachment: Malicious zip file matching zipline campaign severity medium
Attachment: Microsoft 365 credential phishing severity high
Attachment: Microsoft impersonation via PDF with link and suspicious language severity high
Attachment: Microsoft OAuth credential harvesting via EML with embedded malicious links severity high
Attachment: Microsoft SharePoint Impersonation via images in macro-enabled attachment severity high
Attachment: MS Office or RTF file with Shell.Explorer.1 com object with embedded LNK severity medium
Attachment: MS OOXML file created by Administrator with zero edit time severity high
Attachment: MSI installer file severity medium
Attachment: Office document loads remote document template severity medium
Attachment: Office document with VSTO add-in severity high
Attachment: Office file contains OLE relationship to credential phishing page severity high
Attachment: Office file with credential phishing URLs severity medium
Attachment: Office file with document sharing and browser instruction lures severity high
Attachment: Office file with suspicious function calls or downloaded file path severity high
Attachment: OLE external relationship containing file scheme link to executable filetype severity high
Attachment: OLE external relationship containing file scheme link to IP address severity high
Attachment: Password-protected PDF with fake document indicators severity medium
Attachment: PDF Attachment with links to workers.dev severity medium
Attachment: PDF bid/proposal lure with credential theft indicators severity medium
Attachment: PDF contains W9 or invoice YARA signatures severity medium
Attachment: PDF file with link to fake Bitcoin exchange severity low
Attachment: PDF file with low reputation link to ZIP file (unsolicited) severity medium
Attachment: PDF file with low reputation links to suspicious filetypes (unsolicited) severity medium
Attachment: PDF file with recipient domain and ATT eCheckRun pattern severity medium
Attachment: PDF generated with wkhtmltopdf tool and default title severity low
Attachment: PDF Object Hash - Encrypted PDFs with fake payment notification severity medium
Attachment: PDF Object Hash associated with a fake invoice and a W-9 severity high
Attachment: PDF Object Hash associated with fake Canada Revenue Agency documents severity medium
Attachment: PDF Object Hash with Blue File Icon severity medium
Attachment: PDF proposal with credential theft indicators severity high
Attachment: PDF with a suspicious string and single URL severity high
Attachment: PDF with base64 JavaScript and eval functions severity medium
Attachment: PDF with blurry lure image severity medium
Attachment: PDF with credential theft language and invalid reply-to domain severity medium
Attachment: PDF with credential theft language and link to a free subdomain (unsolicited) severity medium
Attachment: PDF with CVE-2026-34621 lures severity high
Attachment: PDF with eCheckRun lures severity medium
Attachment: PDF with fake invoice using suspicious font sizing severity medium
Attachment: PDF with JSFck obfuscation severity high
Attachment: PDF with link to DMG file download severity medium
Attachment: PDF with link to zip containing a wsf file severity high
Attachment: PDF with localhost IP in EXIF title metadata severity medium
Attachment: PDF with Microsoft Purview message impersonation severity medium
Attachment: PDF with multistage landing - ClickUp abuse severity high
Attachment: PDF with password in filename matching body text severity medium
Attachment: PDF with personal Microsoft OneNote URL severity medium
Attachment: PDF with QR code containing recipient-specific credential theft content severity high
Attachment: PDF with quote lure severity medium
Attachment: PDF with recipient email in link severity high
Attachment: PDF With SAI Global ISO9001 Logo severity high
Attachment: PDF with secure document acknowledgment prompt severity medium
Attachment: PDF with self-service platform links with self sender or blank recipients severity medium
Attachment: PDF with specific author metadata severity high
Attachment: PDF with specific W-9 lure severity medium
Attachment: PDF with split QR code severity medium
Attachment: PDF with suspicious document view lure severity medium
Attachment: PDF with suspicious HeadlessChrome metadata severity medium
Attachment: PDF with suspicious internal object reference identifier severity medium
Attachment: PDF with suspicious language and redirect to suspicious file type severity high
Attachment: PDF with suspicious link and action-oriented language severity high
Attachment: PDF with suspicious view document characteristics severity medium
Attachment: PDF with W-9 form indicators severity high
Attachment: Potential sandbox evasion in Office file severity high
Attachment: PowerPoint with suspicious hyperlink severity high
Attachment: PowerShell content severity high
Attachment: QR code link with base64-encoded recipient address severity high
Attachment: QR code with credential phishing indicators severity medium
Attachment: QR code with encoded recipient targeting and redirect indicators severity high
Attachment: QR code with recipient targeting and special characters severity high
Attachment: QR code with userinfo portion severity high
Attachment: RDP connection file severity medium
Attachment: RFC822 containing suspicious file sharing language with links from untrusted sender severity medium
Attachment: RFP/RFQ impersonating government entities severity high
Attachment: Romance scam with image lure and advance-fee or suspicious link indicators severity medium
Attachment: RTF file with suspicious link severity medium
Attachment: RTF with embedded content severity medium
Attachment: RTF with link to free-hosted Cloudflare Pages severity high
Attachment: Self-sender PDF with minimal content and view prompt severity high
Attachment: SFX archive containing commands severity medium
Attachment: Single-page PDF with S3-hosted HTML link severity medium
Attachment: Small text file with link containing recipient email address severity medium
Attachment: Soda PDF producer with encryption themes severity high
Attachment: Suspicious employee policy update document lure severity medium
Attachment: Suspicious PDF created with headless browser severity high
Attachment: SVG file execution severity high
Attachment: SVG file with HTML entity encoded href attributes severity medium
Attachment: SVG file with hyperlinks and cursor styling severity medium
Attachment: SVG files with evasion elements severity high
Attachment: TAR file with RAR type severity high
Attachment: Targeted DOCX with personalized recipient acknowledgement lure severity medium
Attachment: Uncommon compressed file severity low
Attachment: USDA bid invitation impersonation severity medium
Attachment: Web files with suspicious comments severity high
Attachment: WinRAR CVE-2025-8088 exploitation severity high
Attachment: XLSX file with suspicious print titles metadata severity high
Attachment: Zip exploiting CVE-2023-38831 (unsolicited) severity critical
Attachment: ZIP file with CVE-2026-0866 exploit severity medium
BEC/Fraud: Job scam fake thread or plaintext pivot to freemail severity medium
Benefits enrollment impersonation severity high
Body: CSS clamp() font obfuscation with IP-based links severity medium
Brand impersonation: Adobe (QR code) severity high
Brand impersonation: Adobe Acrobat Sign PDF phishing file format template severity high
Brand impersonation: Adobe Sign with suspicious indicators severity high
Brand impersonation: Adobe with suspicious language and link severity high
Brand impersonation: Amazon with suspicious attachment severity medium
Brand impersonation: Canada Revenue Agency severity medium
Brand impersonation: Capital One severity high
Brand impersonation: Chase bank with credential phishing indicators severity medium
Brand impersonation: Coinbase with suspicious links severity medium
Brand impersonation: Discord notification severity medium
Brand impersonation: DocuSign severity high
Brand impersonation: DocuSign (QR code) severity high
Brand impersonation: DocuSign branded attachment lure with no DocuSign links severity high
Brand impersonation: DocuSign PDF attachment with suspicious link severity high
Brand impersonation: Dropbox severity medium
Brand impersonation: Fake Fax severity medium
Brand impersonation: Fake procurement/RFQ PDF from energy and industrial companies severity high
Brand Impersonation: Google (QR Code) severity high
Brand impersonation: Google Drive fake file share severity medium
Brand impersonation: Google fake sign-in warning severity high
Brand impersonation: Microsoft severity high
Brand impersonation: Microsoft (QR code) severity high
Brand impersonation: Microsoft fake sign-in alert severity medium
Brand impersonation: Microsoft logo or suspicious language with open redirect severity high
Brand impersonation: Microsoft Planner with suspicious link severity medium
Brand impersonation: Microsoft quarantine release notification in body severity high
Brand impersonation: Microsoft quarantine release notification in image attachment severity high
Brand impersonation: Microsoft Teams severity high
Brand impersonation: Microsoft with embedded logo and credential theft language severity high
Brand impersonation: Microsoft with low reputation links severity medium
Brand impersonation: Norton severity low
Brand Impersonation: PayPal severity medium
Brand Impersonation: Procore severity medium
Brand impersonation: Proofpoint secure messaging without legitimate indicators severity high
Brand Impersonation: ShareFile severity medium
Brand impersonation: Sharepoint severity high
Brand impersonation: Sharepoint fake file share severity medium
Brand impersonation: SharePoint PDF attachment with credential theft language severity medium
Brand Impersonation: Shein severity medium
Brand impersonation: Social Security Administration severity medium
Brand Impersonation: Stripe severity high
Brand impersonation: Wise severity high
Business Email Compromise (BEC) attempt from untrusted sender severity medium
Callback phishing in body or attachment (untrusted sender) severity medium
Callback phishing via calendar invite severity medium
Callback phishing via extensionless rfc822 attachment severity high
Callback phishing via Google Group abuse severity high
Callback phishing via Google Meet severity medium
Callback phishing via Intuit service abuse severity medium
Callback phishing via Zoho service abuse severity medium
Callback phishing: AOL senders with suspicious HTML template or PDF attachment severity high
Callback phishing: Social Security Administration fraud severity medium
ClickFunnels link infrastructure abuse severity high
Commonly abused sender TLD with engaging language severity medium
Compensation review with QR code in attached EML severity high
Constant Contact link infrastructure abuse severity high
Credential phishing content and link (untrusted sender) severity high
Credential phishing language and suspicious indicators (unknown sender) severity medium
Credential phishing link (unknown sender) severity high
Credential phishing: 'Secure message' and engaging language severity medium
Credential phishing: Blue button styled link with file-sharing template artifacts severity low
Credential phishing: DocuSign embedded image lure with no DocuSign domains in links severity high
Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
Credential phishing: Fake password expiration from new and unsolicited sender severity medium
Credential phishing: Fake storage alerts (unsolicited) severity medium
Credential phishing: Hyper-linked image leading to free file host severity medium
Credential phishing: Image as content, short or no body contents severity medium
Credential phishing: Onedrive impersonation severity high
Display name and subject impersonation using recipient SLD (new sender) severity medium
Display name impersonation using recipient SLD severity medium
DLP - Clear-Text Credentials Outbound severity critical
DLP - PCI: American Express Credit Card Number severity high
DLP - PCI: Discover Credit Card Number severity high
DLP - PCI: Mastercard Credit Card Number severity high
DLP - PCI: US Credit Card Number (Any Network) severity high
DLP - PCI: Visa Credit Card Number severity high
DLP: Australia Credit Card Number severity high
DLP: Canada Credit Card Number severity high
DLP: EU Debit Card Number severity high
DLP: France Credit Card Number severity high
DLP: France Debit Card Number severity high
DLP: Israel Credit Card Number severity high
DLP: Japan Credit Card Number severity high
EML attachment with credential theft language (unknown sender) severity high
Encrypted Microsoft Office files from untrusted sender severity medium
Extortion / Sextortion - PDF attachment leveraging breach data from freemail sender severity high
Extortion / sextortion in attachment from untrusted sender severity low
Fake thread with suspicious indicators severity medium
Fake voicemail notification (untrusted sender) severity medium
HTML smuggling containing recipient email address severity medium
Image as content with a link to an open redirect severity high
Impersonation: Human Resources with link or attachment and engaging language severity medium
Impersonation: Internal corporate services severity high
Impersonation: Recipient organization in sender display name with credential theft image severity medium
Impersonation: SharePoint reply header anomaly severity medium
Inline image as message with attachment or link severity low
Link: Direct POWR.io Form Builder with suspicious patterns severity medium
Link: File sharing pretext with suspicious body and link severity medium
Link: Mamba 2FA phishing kit severity high
Link: Microsoft protected message with matching sender and recipient addresses severity medium
Link: PDF and financial display text to free file host severity high
Link: PDF filename impersonation with credential theft language severity medium
Link: QR code in EML attachment with credential phishing indicators severity high
Link: QR code with phishing disposition in img or pdf severity high
Link: QR Code with suspicious language (untrusted sender) severity medium
Link: QuickBooks image lure with suspicious link severity medium
Link: Self-sender with sender org in subject and credential theft indicator severity high
macOS malware: Compiled AppleScript with document double-extension severity high
MalwareBazaar: Malicious attachment hash (trusted reporters) severity high
MalwareBazaar: Malicious attachment hash in archive (trusted reporters) severity high
Non-RFC compliant calendar files from unsolicited sender severity medium
Open Redirect: Google domain with /url path and suspicious indicators severity medium
Open redirect: Hakumonkai.org severity high
Open redirect: Indeed severity medium
Open redirect: Linkedin severity medium
Open redirect: typedrawers.com severity medium
Open redirect: YouTube severity medium
PDF attachment with Google (AE) redirecting to a php or zip file severity high
PhaaS: Impact Solutions (Impact Vector Suite) severity medium
PHP Mailer with common phishing attachments severity medium
QR Code with suspicious indicators severity high
Reconnaissance: Large unknown recipient list severity low
Request for Quote or Purchase (RFQ|RFP) with HTML smuggling attachment severity high
Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern severity medium
Scam: Piano giveaway severity medium
Self-sent fake PDF attachment with misleading link severity low
Service abuse: Citrix ShareFile impersonation via Outlook plugin severity medium
Service abuse: Monday.com infrastructure with phishing intent severity high
Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com) severity low
Spam: Unsolicited malformed PDF severity low
Stripe invoice abuse severity medium
Suspicious attachment with unscannable Cloudflare link severity medium
Suspicious attachment: Duplicate decoy PDF files severity medium
Suspicious invoice reference with missing or image-only attachments severity high
Suspicious message with unscannable Cloudflare link severity medium
Suspicious message with unscannable Vercel link severity medium
Suspicious Office 365 app authorization (OAuth) link severity high
Suspicious VBA macros from untrusted sender severity high
URI protocol handler: search-ms severity high
URLhaus: Malicious domain in message body or pdf attachment (trusted reporters) severity medium
VIP / Executive impersonation (strict match, untrusted) severity high
VIP / Executive impersonation in subject (untrusted) severity medium
VIP impersonation with charitable donation fraud severity high
VIP impersonation: Fake thread with VIPs missing email metadata severity high
VIP impersonation: Invoice fraud with mobile device sign-off severity high
VIP impersonation: Payment handoff with VIP display name authored fake threads severity high
VIP impersonation: VIP payment redirect handoff via fake threads severity high
X (Twitter) impersonation with credential phishing motives severity medium