Detection rules › Sublime MQL
Attachment: Fake voicemail via PDF
Identifies inbound messages containing a single-page PDF attachment related to voicemail or missed call notifications that includes either a URL or QR code.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | PDF, QR code, Social engineering |
Event coverage
Rule body MQL
type.inbound
// a single PDF attachment
and length(attachments) == 1
// the subject doesn't contain fax, which is currently a common match for the topic
and not strings.icontains(subject.base, 'fax')
and (
length(body.current_thread.text) == 0
or (
ml.nlu_classifier(body.current_thread.text).language == "english"
and (
any(ml.nlu_classifier(body.current_thread.text).topics,
.confidence == "high"
and .name == "Voicemail Call and Missed Call Notifications"
)
or any(ml.nlu_classifier(body.current_thread.text).intents,
.confidence == "high" and .name == "bec"
)
)
)
)
// the Topic analysis of the PDF is Voicemail
and any(attachments,
.file_extension == "pdf"
// the NLU detected language is english
and ml.nlu_classifier(beta.ocr(.).text).language == "english"
and length(beta.ocr(.).text) > 95
and any(ml.nlu_classifier(beta.ocr(.).text).topics,
.confidence == "high"
and .name == "Voicemail Call and Missed Call Notifications"
)
and beta.ocr(.).success
// contains a link or QR code
and any(file.explode(.),
0 < length(.scan.pdf.urls) <= 2 or .scan.qr.url.url is not null
)
// there is only a single page
and any(file.explode(.), .depth == 0 and .scan.exiftool.page_count == 1)
)
and not (
sender.email.domain.root_domain == "zendesk.com"
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Detection logic
Scope: inbound message.
Identifies inbound messages containing a single-page PDF attachment related to voicemail or missed call notifications that includes either a URL or QR code.
- inbound message
- length(attachments) is 1
not:
- subject.base contains 'fax'
any of:
- length(body.current_thread.text) is 0
all of:
- ml.nlu_classifier(body.current_thread.text).language is 'english'
any of:
any of
ml.nlu_classifier(body.current_thread.text).topicswhere all hold:- .confidence is 'high'
- .name is 'Voicemail Call and Missed Call Notifications'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .confidence is 'high'
- .name is 'bec'
any of
attachmentswhere all hold:- .file_extension is 'pdf'
- ml.nlu_classifier(beta.ocr(.).text).language is 'english'
- length(beta.ocr(.).text) > 95
any of
ml.nlu_classifier(beta.ocr(.).text).topicswhere all hold:- .confidence is 'high'
- .name is 'Voicemail Call and Missed Call Notifications'
- beta.ocr(.).success
any of
file.explode(.)where any holds:all of:
- length(.scan.pdf.urls) > 0
- length(.scan.pdf.urls) ≤ 2
- .scan.qr.url.url is set
any of
file.explode(.)where all hold:- .depth is 0
- .scan.exiftool.page_count is 1
not:
all of:
- sender.email.domain.root_domain is 'zendesk.com'
- coalesce(headers.auth_summary.dmarc.pass)
Inspects: attachments[].file_extension, body.current_thread.text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, subject.base, type.inbound. Sensors: beta.ocr, file.explode, ml.nlu_classifier, strings.icontains.
Indicators matched (9)
| Field | Match | Value |
|---|---|---|
strings.icontains | substring | fax |
ml.nlu_classifier(body.current_thread.text).topics[].confidence | equals | high |
ml.nlu_classifier(body.current_thread.text).topics[].name | equals | Voicemail Call and Missed Call Notifications |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | equals | high |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | bec |
attachments[].file_extension | equals | pdf |
ml.nlu_classifier(beta.ocr(attachments[]).text).topics[].confidence | equals | high |
ml.nlu_classifier(beta.ocr(attachments[]).text).topics[].name | equals | Voicemail Call and Missed Call Notifications |
sender.email.domain.root_domain | equals | zendesk.com |