Detection rules › Sublime MQL
Attachment: Adobe Sign lure PDF with embedded banner images
Detects inbound messages containing PDF attachments that contain embedded banner images mimicking Adobe Sign branding, commonly used to deceive recipients into believing the document is legitimate.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | PDF, Impersonation: Brand |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(attachments, .file_type == "pdf"),
any(file.explode(.),
any(.scan.yara.matches, .name == 'adobe_sign_lure_banner_images')
)
)
Detection logic
Scope: inbound message.
Detects inbound messages containing PDF attachments that contain embedded banner images mimicking Adobe Sign branding, commonly used to deceive recipients into believing the document is legitimate.
- inbound message
any of
filter(attachments)where:any of
file.explode(.)where:any of
.scan.yara.matcheswhere:- .name is 'adobe_sign_lure_banner_images'
Inspects: attachments[].file_type, type.inbound. Sensors: file.explode.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
file.explode(filter(attachments)[])[].scan.yara.matches[].name | equals | adobe_sign_lure_banner_images |