Sublime-Message-attachments Event ID 7000000

Sublime MQL (364)

• Adobe branded PDF file linking to a password-protected file from untrusted sender severity high
• Attachment soliciting user to enable macros severity high
• Attachment with auto-executing macro (unsolicited) severity medium
• Attachment with auto-opening VBA macro (unsolicited) severity medium
• Attachment with encrypted zip (unsolicited) severity medium
• Attachment with high risk VBA macro (unsolicited) severity high
• Attachment with macro calling executable severity high
• Attachment with suspicious author (unsolicited) severity high
• Attachment with unscannable encrypted zip severity medium
• Attachment with VBA macros from employee impersonation (unsolicited) severity high
• Attachment: .csproj with suspicious commands severity high
• Attachment: 7z Archive Containing RAR File severity medium
• Attachment: Adobe image lure in body or attachment with suspicious link severity medium
• Attachment: Adobe Sign lure PDF with embedded banner images severity medium
• Attachment: Any .sap file (unsolicited) severity low
• Attachment: Any HTML file (unsolicited) severity low
• Attachment: Any HTML file (untrusted sender) severity medium
• Attachment: Any HTML file within archive (unsolicited) severity medium
• Attachment: Archive containing disallowed file type severity low
• Attachment: Archive containing HTML file with file scheme link severity high
• Attachment: Archive contains DLL-loading macro severity high
• Attachment: Archive with embedded CHM file severity medium
• Attachment: Archive with embedded EXE file severity high
• Attachment: Archive with pdf, txt and wsf files severity medium
• Attachment: Base64 encoded bash command in filename severity high
• Attachment: Calendar file with invisible Unicode characters severity high
• Attachment: Calendar invite from recently registered domain severity high
• Attachment: Calendar invite with Google redirect and invoice request severity medium
• Attachment: Calendar invite with suspicious link leading to an open redirect severity high
• Attachment: Callback phishing solicitation via image file severity high
• Attachment: Callback phishing solicitation via pdf file severity high
• Attachment: Callback phishing solicitation via text-based file severity medium
• Attachment: Canva PDF with susupicious author metadata severity high
• Attachment: cmd file extension severity low
• Attachment: Cold outreach with invitation subject and not attachment severity high
• Attachment: Compensation review lure with QR code severity high
• Attachment: Compensation-themed DOCX with QR code credential theft severity high
• Attachment: CVE-2021-40444 - MSHTML Remote Code Execution Vulnerability severity critical
• Attachment: CVE-2023-21716 - Microsoft Office Remote Code Execution Vulnerability severity high
• Attachment: CVE-2025-24071 - Microsoft Windows File Explorer Spoofing Vulnerability severity critical
• Attachment: Decoy PDF author (Julie P.) severity high
• Attachment: DocuSign impersonation via PDF linking to new domain severity medium
• Attachment: DocX embedded binary severity high
• Attachment: DOCX with hyperlink targeting recipient address severity medium
• Attachment: Double base64-encoded zip file in HTML smuggling attachment severity high
• Attachment: Dropbox image lure with no Dropbox domains in links severity medium
• Attachment: EICAR string present severity low
• Attachment: Embedded Javascript in SVG file severity high
• Attachment: Embedded VBScript in MHT file severity medium
• Attachment: EML containing a base64 encoded script severity high
• Attachment: EML file contains HTML attachment with login portal indicators severity high
• Attachment: EML file with HTML attachment (unsolicited) severity medium
• Attachment: EML file with IPFS links severity medium
• Attachment: EML with embedded Javascript in SVG file severity high
• Attachment: EML with Encrypted ZIP severity low
• Attachment: EML with link to credential phishing page severity high
• Attachment: EML with SharePoint files shared from GoDaddy federated tenants severity low
• Attachment: EML with Sharepoint link likely unrelated to sender severity medium
• Attachment: EML with suspicious indicators severity medium
• Attachment: Emotet heavily padded doc in zip file severity high
• Attachment: Employment contract update with suspicious file naming severity high
• Attachment: Encrypted Microsoft Office file (unsolicited) severity medium
• Attachment: Encrypted PDF With Credential Harvesting Indicators severity medium
• Attachment: Encrypted PDF with credential theft body severity medium
• Attachment: Encrypted ZIP containing VHDX file severity medium
• Attachment: Encrypted zip file with payment-related lure severity medium
• Attachment: Excel file with document sharing lure created by Go Excelize severity high
• Attachment: Excel file with suspicious template identifier severity high
• Attachment: Excel Web Query File (IQY) severity high
• Attachment: Fake attachment image lure severity medium
• Attachment: Fake PDF Invoices Yara severity medium
• Attachment: Fake scan-to-email severity medium
• Attachment: Fake Slack installer severity high
• Attachment: Fake voicemail via PDF severity medium
• Attachment: Fake Zoom installer severity high
• Attachment: Fictitious invoice using LinkedIn's address severity medium
• Attachment: File execution via Javascript severity medium
• Attachment: Filename containing Unicode braille pattern blank character severity high
• Attachment: Filename containing Unicode right-to-left override character severity high
• Attachment: Finance themed PDF with observed phishing template severity medium
• Attachment: HTML attachment with Javascript location severity high
• Attachment: HTML attachment with login portal indicators severity medium
• Attachment: HTML file contains exclusively Javascript severity medium
• Attachment: HTML file with excessive 'const' declarations and abnormally long timeouts severity high
• Attachment: HTML file with excessive padding and suspicious patterns severity high
• Attachment: HTML file with reference to recipient and suspicious patterns severity high
• Attachment: HTML smuggling 'body onload' linking to suspicious destination severity high
• Attachment: HTML smuggling 'body onload' with high entropy and suspicious text severity high
• Attachment: HTML smuggling - QR Code with suspicious links severity high
• Attachment: HTML smuggling Microsoft sign in severity high
• Attachment: HTML smuggling with atob and high entropy severity high
• Attachment: HTML smuggling with atob and high entropy via calendar invite severity high
• Attachment: HTML smuggling with auto-downloaded file severity high
• Attachment: HTML smuggling with base64 encoded JavaScript function severity high
• Attachment: HTML smuggling with base64 encoded ZIP file severity medium
• Attachment: HTML smuggling with concatenation obfuscation severity high
• Attachment: HTML smuggling with decimal encoding severity high
• Attachment: HTML smuggling with embedded base64 streamed file download severity high
• Attachment: HTML smuggling with embedded base64-encoded executable severity high
• Attachment: HTML smuggling with embedded base64-encoded ISO severity high
• Attachment: HTML smuggling with eval and atob severity high
• Attachment: HTML smuggling with eval and atob via calendar invite severity high
• Attachment: HTML smuggling with excessive line break obfuscation severity high
• Attachment: HTML smuggling with excessive string concatenation and suspicious patterns severity medium
• Attachment: HTML smuggling with fromCharCode and other signals severity high
• Attachment: HTML smuggling with hex strings severity medium
• Attachment: HTML smuggling with high entropy and other signals severity high
• Attachment: HTML smuggling with raw array buffer severity high
• Attachment: HTML smuggling with RC4 decryption severity high
• Attachment: HTML smuggling with ROT13 severity high
• Attachment: HTML smuggling with setTimeout severity high
• Attachment: HTML smuggling with unescape severity high
• Attachment: HTML with emoji-to-character map severity high
• Attachment: HTML with hidden body severity high
• Attachment: HTML with JavaScript functions for HTTP requests severity high
• Attachment: HTML with obfuscation and recipient's email in JavaScript strings severity high
• Attachment: ICS calendar file with base64 encoded recipient address in URL parameters severity high
• Attachment: ICS calendar file with QR code containing recipient email address severity high
• Attachment: ICS calendar file with recipient address in UID field severity high
• Attachment: ICS calendar file with suspicious product identifier severity medium
• Attachment: ICS calendar with embedded file from internal sender with SPF failure severity high
• Attachment: ICS file with AWS Lambda URL severity medium
• Attachment: ICS file with excessive custom properties severity medium
• Attachment: ICS file with links to newly registered domains severity medium
• Attachment: ICS file with meeting prefix severity high
• Attachment: ICS file with non-Gregorian calendar scale severity medium
• Attachment: ICS with embedded document severity low
• Attachment: ICS with embedded Javascript in SVG file severity high
• Attachment: ICS with employee policy review lure severity high
• Attachment: Invoice and W-9 PDFs with suspicious creators severity high
• Attachment: JavaScript file with suspicious base64-encoded executable severity high
• Attachment: JPEG with gd-jpeg creator and suspicious file name severity high
• Attachment: Legal themed message or PDF with suspicious indicators severity medium
• Attachment: Link file with UNC path severity medium
• Attachment: Link to Doubleclick.net open redirect severity medium
• Attachment: LNK file severity high
• Attachment: LNK with embedded content severity high
• Attachment: Macro files containing MHT content severity medium
• Attachment: Macro with suspected use of COM ShellBrowserWindow object for process creation severity high
• Attachment: Malformed OLE file severity high
• Attachment: Malicious OneNote commands severity high
• Attachment: Microsoft 365 credential phishing severity high
• Attachment: Microsoft impersonation via PDF with link and suspicious language severity high
• Attachment: Microsoft OAuth credential harvesting via EML with embedded malicious links severity high
• Attachment: MS Office or RTF file with Shell.Explorer.1 com object with embedded LNK severity medium
• Attachment: MS OOXML file created by Administrator with zero edit time severity high
• Attachment: MSI installer file severity medium
• Attachment: Office document loads remote document template severity medium
• Attachment: Office document with VSTO add-in severity high
• Attachment: Office file contains OLE relationship to credential phishing page severity high
• Attachment: Office file with credential phishing URLs severity medium
• Attachment: Office file with document sharing and browser instruction lures severity high
• Attachment: Office file with suspicious function calls or downloaded file path severity high
• Attachment: OLE external relationship containing file scheme link to executable filetype severity high
• Attachment: OLE external relationship containing file scheme link to IP address severity high
• Attachment: Password-protected PDF with fake document indicators severity medium
• Attachment: PDF Attachment with links to workers.dev severity medium
• Attachment: PDF bid/proposal lure with credential theft indicators severity medium
• Attachment: PDF contains W9 or invoice YARA signatures severity medium
• Attachment: PDF file with link to fake Bitcoin exchange severity low
• Attachment: PDF file with low reputation link to ZIP file (unsolicited) severity medium
• Attachment: PDF file with low reputation links to suspicious filetypes (unsolicited) severity medium
• Attachment: PDF generated with wkhtmltopdf tool and default title severity low
• Attachment: PDF Object Hash - Encrypted PDFs with fake payment notification severity medium
• Attachment: PDF Object Hash with Blue File Icon severity medium
• Attachment: PDF proposal with credential theft indicators severity high
• Attachment: PDF with a suspicious string and single URL severity high
• Attachment: PDF with blurry lure image severity medium
• Attachment: PDF with credential theft language and invalid reply-to domain severity medium
• Attachment: PDF with credential theft language and link to a free subdomain (unsolicited) severity medium
• Attachment: PDF with CVE-2026-34621 lures severity high
• Attachment: PDF with eCheckRun lures severity medium
• Attachment: PDF with fake invoice using suspicious font sizing severity medium
• Attachment: PDF with JSFck obfuscation severity high
• Attachment: PDF with link to DMG file download severity medium
• Attachment: PDF with link to zip containing a wsf file severity high
• Attachment: PDF with Microsoft Purview message impersonation severity medium
• Attachment: PDF with multistage landing - ClickUp abuse severity high
• Attachment: PDF with password in filename matching body text severity medium
• Attachment: PDF with personal Microsoft OneNote URL severity medium
• Attachment: PDF with QR code containing recipient-specific credential theft content severity high
• Attachment: PDF with recipient email in link severity high
• Attachment: PDF With SAI Global ISO9001 Logo severity high
• Attachment: PDF with self-service platform links with self sender or blank recipients severity medium
• Attachment: PDF with specific author metadata severity high
• Attachment: PDF with split QR code severity medium
• Attachment: PDF with suspicious HeadlessChrome metadata severity medium
• Attachment: PDF with suspicious language and redirect to suspicious file type severity high
• Attachment: PDF with suspicious link and action-oriented language severity high
• Attachment: PDF with suspicious view document characteristics severity medium
• Attachment: Potential sandbox evasion in Office file severity high
• Attachment: PowerPoint with suspicious hyperlink severity high
• Attachment: PowerShell content severity high
• Attachment: QR code link with base64-encoded recipient address severity high
• Attachment: QR code with credential phishing indicators severity medium
• Attachment: QR code with encoded recipient targeting and redirect indicators severity high
• Attachment: QR code with recipient targeting and special characters severity high
• Attachment: QR code with userinfo portion severity high
• Attachment: RDP connection file severity medium
• Attachment: RFC822 containing suspicious file sharing language with links from untrusted sender severity medium
• Attachment: RFP/RFQ impersonating government entities severity high
• Attachment: RTF file with suspicious link severity medium
• Attachment: RTF with embedded content severity medium
• Attachment: Self-sender PDF with minimal content and view prompt severity high
• Attachment: SFX archive containing commands severity medium
• Attachment: Small text file with link containing recipient email address severity medium
• Attachment: Soda PDF producer with encryption themes severity high
• Attachment: Suspicious employee policy update document lure severity medium
• Attachment: Suspicious PDF created with headless browser severity high
• Attachment: SVG file execution severity high
• Attachment: SVG file with HTML entity encoded href attributes severity medium
• Attachment: SVG file with hyperlinks and cursor styling severity medium
• Attachment: SVG files with evasion elements severity high
• Attachment: TAR file with RAR type severity high
• Attachment: Uncommon compressed file severity low
• Attachment: USDA bid invitation impersonation severity medium
• Attachment: Web files with suspicious comments severity high
• Attachment: WinRAR CVE-2025-8088 exploitation severity high
• Attachment: XLSX file with suspicious print titles metadata severity high
• Attachment: Zip exploiting CVE-2023-38831 (unsolicited) severity critical
• Attachment: ZIP file with CVE-2026-0866 exploit severity medium
• BEC/Fraud: Job scam fake thread or plaintext pivot to freemail severity medium
• Benefits enrollment impersonation severity high
• Brand impersonation: Adobe (QR code) severity high
• Brand impersonation: Adobe Acrobat Sign PDF phishing file format template severity high
• Brand impersonation: Adobe Sign with suspicious indicators severity high
• Brand impersonation: Adobe with suspicious language and link severity high
• Brand impersonation: Amazon with suspicious attachment severity medium
• Brand impersonation: Capital One severity high
• Brand impersonation: Chase bank with credential phishing indicators severity medium
• Brand impersonation: Coinbase with suspicious links severity medium
• Brand impersonation: Discord notification severity medium
• Brand impersonation: DocuSign severity high
• Brand impersonation: DocuSign (QR code) severity high
• Brand impersonation: DocuSign branded attachment lure with no DocuSign links severity high
• Brand impersonation: DocuSign PDF attachment with suspicious link severity high
• Brand impersonation: Dropbox severity medium
• Brand impersonation: Fake Fax severity medium
• Brand Impersonation: Google (QR Code) severity high
• Brand impersonation: Google Drive fake file share severity medium
• Brand impersonation: Google fake sign-in warning severity high
• Brand impersonation: Microsoft severity high
• Brand impersonation: Microsoft (QR code) severity high
• Brand impersonation: Microsoft fake sign-in alert severity medium
• Brand impersonation: Microsoft logo or suspicious language with open redirect severity high
• Brand impersonation: Microsoft Planner with suspicious link severity medium
• Brand impersonation: Microsoft quarantine release notification in body severity high
• Brand impersonation: Microsoft quarantine release notification in image attachment severity high
• Brand impersonation: Microsoft Teams severity high
• Brand impersonation: Microsoft with embedded logo and credential theft language severity high
• Brand impersonation: Microsoft with low reputation links severity medium
• Brand impersonation: Norton severity low
• Brand Impersonation: PayPal severity medium
• Brand Impersonation: Procore severity medium
• Brand impersonation: Proofpoint secure messaging without legitimate indicators severity high
• Brand Impersonation: ShareFile severity medium
• Brand impersonation: Sharepoint severity high
• Brand impersonation: Sharepoint fake file share severity medium
• Brand impersonation: SharePoint PDF attachment with credential theft language severity medium
• Brand Impersonation: Shein severity medium
• Brand impersonation: Social Security Administration severity medium
• Brand Impersonation: Stripe severity high
• Brand impersonation: Wise severity high
• Business Email Compromise (BEC) attempt from untrusted sender severity medium
• Callback phishing in body or attachment (untrusted sender) severity medium
• Callback phishing via calendar invite severity medium
• Callback phishing via extensionless rfc822 attachment severity high
• Callback phishing via Google Group abuse severity high
• Callback phishing via Google Meet severity medium
• Callback phishing via Intuit service abuse severity medium
• Callback phishing via Zoho service abuse severity medium
• Callback phishing: AOL senders with suspicious HTML template or PDF attachment severity high
• Callback phishing: Social Security Administration fraud severity medium
• ClickFunnels link infrastructure abuse severity high
• Commonly abused sender TLD with engaging language severity medium
• Compensation review with QR code in attached EML severity high
• Constant Contact link infrastructure abuse severity high
• Credential phishing content and link (untrusted sender) severity high
• Credential phishing language and suspicious indicators (unknown sender) severity medium
• Credential phishing link (unknown sender) severity high
• Credential phishing: 'Secure message' and engaging language severity medium
• Credential phishing: Blue button styled link with file-sharing template artifacts severity low
• Credential phishing: DocuSign embedded image lure with no DocuSign domains in links severity high
• Credential phishing: Engaging language and other indicators (untrusted sender) severity medium
• Credential phishing: Fake password expiration from new and unsolicited sender severity medium
• Credential phishing: Fake storage alerts (unsolicited) severity medium
• Credential phishing: Hyper-linked image leading to free file host severity medium
• Credential phishing: Image as content, short or no body contents severity medium
• Credential phishing: Onedrive impersonation severity high
• Display name and subject impersonation using recipient SLD (new sender) severity medium
• Display name impersonation using recipient SLD severity medium
• DLP - PCI: American Express Credit Card Number severity high
• DLP - PCI: Discover Credit Card Number severity high
• DLP - PCI: Mastercard Credit Card Number severity high
• DLP - PCI: US Credit Card Number (Any Network) severity high
• DLP - PCI: Visa Credit Card Number severity high
• DLP: Australia Credit Card Number severity high
• DLP: Canada Credit Card Number severity high
• DLP: EU Debit Card Number severity high
• DLP: France Credit Card Number severity high
• DLP: France Debit Card Number severity high
• DLP: Israel Credit Card Number severity high
• DLP: Japan Credit Card Number severity high
• EML attachment with credential theft language (unknown sender) severity high
• Encrypted Microsoft Office files from untrusted sender severity medium
• Extortion / Sextortion - PDF attachment leveraging breach data from freemail sender severity high
• Extortion / sextortion in attachment from untrusted sender severity low
• Fake thread with suspicious indicators severity medium
• Fake voicemail notification (untrusted sender) severity medium
• HTML smuggling containing recipient email address severity medium
• Image as content with a link to an open redirect severity high
• Impersonation: Human Resources with link or attachment and engaging language severity medium
• Impersonation: Internal corporate services severity high
• Impersonation: Recipient organization in sender display name with credential theft image severity medium
• Impersonation: SharePoint reply header anomaly severity medium
• Inline image as message with attachment or link severity low
• Link: Direct POWR.io Form Builder with suspicious patterns severity medium
• Link: File sharing pretext with suspicious body and link severity medium
• Link: Mamba 2FA phishing kit severity high
• Link: Microsoft protected message with matching sender and recipient addresses severity medium
• Link: PDF and financial display text to free file host severity high
• Link: PDF filename impersonation with credential theft language severity medium
• Link: QR code in EML attachment with credential phishing indicators severity high
• Link: QR code with phishing disposition in img or pdf severity high
• Link: QR Code with suspicious language (untrusted sender) severity medium
• Link: QuickBooks image lure with suspicious link severity medium
• Link: Self-sender with sender org in subject and credential theft indicator severity high
• macOS malware: Compiled AppleScript with document double-extension severity high
• MalwareBazaar: Malicious attachment hash (trusted reporters) severity high
• MalwareBazaar: Malicious attachment hash in archive (trusted reporters) severity high
• Non-RFC compliant calendar files from unsolicited sender severity medium
• Open Redirect: Google domain with /url path and suspicious indicators severity medium
• Open redirect: Hakumonkai.org severity high
• Open redirect: Indeed severity medium
• Open redirect: Linkedin severity medium
• Open redirect: typedrawers.com severity medium
• Open redirect: YouTube severity medium
• PDF attachment with Google (AE) redirecting to a php or zip file severity high
• PhaaS: Impact Solutions (Impact Vector Suite) severity medium
• PHP Mailer with common phishing attachments severity medium
• QR Code with suspicious indicators severity high
• Reconnaissance: Large unknown recipient list severity low
• Request for Quote or Purchase (RFQ|RFP) with HTML smuggling attachment severity high
• Request for Quote or Purchase (RFQ|RFP) with suspicious sender or recipient pattern severity medium
• Scam: Piano giveaway severity medium
• Self-sent fake PDF attachment with misleading link severity low
• Service abuse: Citrix ShareFile impersonation via Outlook plugin severity medium
• Service abuse: Monday.com infrastructure with phishing intent severity high
• Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com) severity low
• Spam: Unsolicited malformed PDF severity low
• Stripe invoice abuse severity medium
• Suspicious attachment with unscannable Cloudflare link severity medium
• Suspicious attachment: Duplicate decoy PDF files severity medium
• Suspicious invoice reference with missing or image-only attachments severity high
• Suspicious message with unscannable Cloudflare link severity medium
• Suspicious message with unscannable Vercel link severity medium
• Suspicious Office 365 app authorization (OAuth) link severity high
• Suspicious VBA macros from untrusted sender severity high
• URI protocol handler: search-ms severity high
• URLhaus: Malicious domain in message body or pdf attachment (trusted reporters) severity medium
• VIP / Executive impersonation (strict match, untrusted) severity high
• VIP / Executive impersonation in subject (untrusted) severity medium
• VIP impersonation with charitable donation fraud severity high
• X (Twitter) impersonation with credential phishing motives severity medium