Detection rules › Sublime MQL
Attachment: JPEG with gd-jpeg creator and suspicious file name
Detects inbound messages containing a single JPEG attachment with specific filename patterns and EXIF metadata indicating creation by gd-jpeg v1.0. This has been observed being used to produce company logos used within phishing messages.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and length(filter(attachments, .file_type == "jpg")) == 1
and any(attachments,
.file_type == "jpg"
and .file_extension == "jpeg"
and strings.icontains(.file_name, 'images')
and (
strings.count(.file_name, '/') == 1
or strings.count(.file_name, 'image') == 2
)
and any(beta.parse_exif(.).fields,
.key =~ "Comment"
and strings.istarts_with(.value, 'CREATOR: gd-jpeg v1.0')
)
)
Detection logic
Scope: inbound message.
Detects inbound messages containing a single JPEG attachment with specific filename patterns and EXIF metadata indicating creation by gd-jpeg v1.0. This has been observed being used to produce company logos used within phishing messages.
- inbound message
- length(filter(attachments, .file_type == 'jpg')) is 1
any of
attachmentswhere all hold:- .file_type is 'jpg'
- .file_extension is 'jpeg'
- .file_name contains 'images'
any of:
- strings.count(.file_name, '/') is 1
- strings.count(.file_name, 'image') is 2
any of
beta.parse_exif(.).fieldswhere all hold:- .key is 'Comment'
- .value starts with 'CREATOR: gd-jpeg v1.0'
Inspects: attachments[].file_extension, attachments[].file_name, attachments[].file_type, type.inbound. Sensors: beta.parse_exif, strings.count, strings.icontains, strings.istarts_with.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | jpg |
attachments[].file_extension | equals | jpeg |
strings.icontains | substring | images |
beta.parse_exif(attachments[]).fields[].key | equals | Comment |
strings.istarts_with | prefix | CREATOR: gd-jpeg v1.0 |