detection.wiki

Detection rules › Sublime MQL

Attachment: Invoice and W-9 PDFs with suspicious creators

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing two PDF attachments where one has invoice-related naming patterns and another contains W-9 tax form indicators, with at least one PDF generated by Chrome or wkhtmltopdf tools, commonly used in business email compromise attacks targeting financial processes.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud
Tactics and techniquesPDF, Social engineering, Impersonation: Brand

Event coverage

Message attribute
attachments (collection)
headers.auth_summary
sender.email
type

Rule body MQL

type.inbound
and length(distinct(attachments, .sha1)) == 2
and length(filter(attachments, .file_type == "pdf")) == 2
// either of them are chrome/wkhtmltopdf
and any(filter(attachments, .file_type == "pdf"),
        beta.parse_exif(.).creator == "Chromium"
        or strings.icontains(beta.parse_exif(.).creator, "wkhtmltopdf")
        or strings.icontains(beta.parse_exif(.).creator, "HeadlessChrome")
)
and any(attachments,
        strings.istarts_with(.file_name, 'lnv')
        or strings.istarts_with(.file_name, 'inv-')
        or strings.istarts_with(.file_name, "invoice_")
        or regex.contains(.file_name, '^Invoice\s\d{8,9}')
        or regex.contains(.file_name, '^INV[0-9]{7}')
        or regex.contains(.file_name, '^INV#[0-9]{12}')
        or strings.icontains(beta.ocr(.).text, "Executive Business Coaching")
        or strings.icontains(beta.ocr(.).text, "Executive Coaching")
        or strings.icontains(beta.ocr(.).text, "Professional Services")
        or strings.icontains(beta.ocr(.).text, "Business Systems Integration")
        or strings.icontains(beta.ocr(.).text, "Consulting & Advisory")
        or strings.icontains(beta.ocr(.).text, "Zoomlnfo")
)
and any(attachments,
        .file_name == ".pdf"
        or regex.contains(beta.ocr(.).text, 'W[=-]9')
        or regex.icontains(.file_name, 'w-?9')
)
and not (
  sender.email.domain.root_domain in ('intuit.com')
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Detection logic

Scope: inbound message.

Detects messages containing two PDF attachments where one has invoice-related naming patterns and another contains W-9 tax form indicators, with at least one PDF generated by Chrome or wkhtmltopdf tools, commonly used in business email compromise attacks targeting financial processes.

  1. inbound message
  2. length(distinct(attachments, .sha1)) is 2
  3. length(filter(attachments, .file_type == 'pdf')) is 2
  4. any of filter(attachments) where any holds:
    • beta.parse_exif(.).creator is 'Chromium'
    • beta.parse_exif(.).creator contains 'wkhtmltopdf'
    • beta.parse_exif(.).creator contains 'HeadlessChrome'
  5. any of attachments where any holds:
    • .file_name starts with 'lnv'
    • .file_name starts with 'inv-'
    • .file_name starts with 'invoice_'
    • .file_name matches '^Invoice\\s\\d{8,9}'
    • .file_name matches '^INV[0-9]{7}'
    • .file_name matches '^INV#[0-9]{12}'
    • beta.ocr(.).text contains 'Executive Business Coaching'
    • beta.ocr(.).text contains 'Executive Coaching'
    • beta.ocr(.).text contains 'Professional Services'
    • beta.ocr(.).text contains 'Business Systems Integration'
    • beta.ocr(.).text contains 'Consulting & Advisory'
    • beta.ocr(.).text contains 'Zoomlnfo'
  6. any of attachments where any holds:
    • .file_name is '.pdf'
    • beta.ocr(.).text matches 'W[=-]9'
    • .file_name matches 'w-?9'
  7. not:
    • all of:
      • sender.email.domain.root_domain in ('intuit.com')
      • coalesce(headers.auth_summary.dmarc.pass)

Inspects: attachments[].file_name, attachments[].file_type, attachments[].sha1, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: beta.ocr, beta.parse_exif, regex.contains, regex.icontains, strings.icontains, strings.istarts_with.

Indicators matched (19)

FieldMatchValue
attachments[].file_typeequalspdf
strings.icontainssubstringwkhtmltopdf
strings.icontainssubstringHeadlessChrome
strings.istarts_withprefixlnv
strings.istarts_withprefixinv-
strings.istarts_withprefixinvoice_
regex.containsregex^Invoice\s\d{8,9}
regex.containsregex^INV[0-9]{7}
regex.containsregex^INV#[0-9]{12}
strings.icontainssubstringExecutive Business Coaching
strings.icontainssubstringExecutive Coaching
strings.icontainssubstringProfessional Services
7 more
strings.icontainssubstringBusiness Systems Integration
strings.icontainssubstringConsulting & Advisory
strings.icontainssubstringZoomlnfo
attachments[].file_nameequals.pdf
regex.containsregexW[=-]9
regex.icontainsregexw-?9
sender.email.domain.root_domainmemberintuit.com