Detection rules › Sublime MQL

Attachment: Fake PDF Invoices Yara

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

These yara signatures match fake invoice PDFs with specific artifiacts including images and link locations.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware, Credential Phishing
Tactics and techniquesPDF, Social engineering

Event coverage

Rule body MQL

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            any(.scan.yara.matches,
                .name in (
                  "fake_invoice_pdf_structure_01",
                  "fake_invoice_pdf_images_01",
                )
            )
        )
)

Detection logic

Scope: inbound message.

These yara signatures match fake invoice PDFs with specific artifiacts including images and link locations.

  1. inbound message
  2. any of filter(attachments) where:
    • any of file.explode(.) where:
      • any of .scan.yara.matches where:
        • .name in ('fake_invoice_pdf_structure_01', 'fake_invoice_pdf_images_01')

Inspects: attachments[].file_type, type.inbound. Sensors: file.explode.

Indicators matched (3)

FieldMatchValue
attachments[].file_typeequalspdf
file.explode(filter(attachments)[])[].scan.yara.matches[].namememberfake_invoice_pdf_structure_01
file.explode(filter(attachments)[])[].scan.yara.matches[].namememberfake_invoice_pdf_images_01