Detection rules › Sublime MQL
Attachment: Canva PDF with susupicious author metadata
Detects inbound messages containing PDF attachments that were created using Canva but have author metadata containing '@proton.me', indicating potential service abuse where legitimate design tools are being misused in conjunction with privacy-focused email services.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Free email provider, PDF |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(attachments, .file_type == "pdf"),
strings.icontains(beta.parse_exif(.).author, '@proton.me')
and beta.parse_exif(.).producer == 'Canva'
)
Detection logic
Scope: inbound message.
Detects inbound messages containing PDF attachments that were created using Canva but have author metadata containing '@proton.me', indicating potential service abuse where legitimate design tools are being misused in conjunction with privacy-focused email services.
- inbound message
any of
filter(attachments)where all hold:- beta.parse_exif(.).author contains '@proton.me'
- beta.parse_exif(.).producer is 'Canva'
Inspects: attachments[].file_type, type.inbound. Sensors: beta.parse_exif, strings.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
strings.icontains | substring | @proton.me |