Detection rules › Sublime MQL

Attachment: Adobe Sign lure PDF with embedded banner images

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages containing PDF attachments that contain embedded banner images mimicking Adobe Sign branding, commonly used to deceive recipients into believing the document is legitimate.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesPDF, Impersonation: Brand

Event coverage

Rule body MQL

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            any(.scan.yara.matches, .name == 'adobe_sign_lure_banner_images')
        )
)

Detection logic

Scope: inbound message.

Detects inbound messages containing PDF attachments that contain embedded banner images mimicking Adobe Sign branding, commonly used to deceive recipients into believing the document is legitimate.

  1. inbound message
  2. any of filter(attachments) where:
    • any of file.explode(.) where:
      • any of .scan.yara.matches where:
        • .name is 'adobe_sign_lure_banner_images'

Inspects: attachments[].file_type, type.inbound. Sensors: file.explode.

Indicators matched (2)

FieldMatchValue
attachments[].file_typeequalspdf
file.explode(filter(attachments)[])[].scan.yara.matches[].nameequalsadobe_sign_lure_banner_images