Detection rules › Sublime MQL
Attachment: PDF with credential theft language and invalid reply-to domain
Detects PDF attachments containing high-confidence credential theft language that references the recipient's email address, combined with an invalid reply-to domain header.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | PDF, Social engineering, Spoofing |
Event coverage
Rule body MQL
type.inbound
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(headers.reply_to, .email.email == "")
and any(attachments,
.file_type == 'pdf'
and any(file.explode(.),
any(ml.nlu_classifier(.scan.strings.raw).intents,
.name == 'cred_theft' and .confidence == 'high'
)
and strings.icontains(.scan.strings.raw,
recipients.to[0].email.email
)
)
)
// negate highly trusted sender domains unless they fail DMARC authentication or DMARC is missing
and not (
sender.email.domain.root_domain in $high_trust_sender_root_domains
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Detection logic
Scope: inbound message.
Detects PDF attachments containing high-confidence credential theft language that references the recipient's email address, combined with an invalid reply-to domain header.
- inbound message
- length(recipients.to) is 1
- recipients.to[0].email.domain.valid
any of
headers.reply_towhere:- .email.email is ''
any of
attachmentswhere all hold:- .file_type is 'pdf'
any of
file.explode(.)where all hold:any of
ml.nlu_classifier(.scan.strings.raw).intentswhere all hold:- .name is 'cred_theft'
- .confidence is 'high'
- strings.icontains(.scan.strings.raw)
not:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
- coalesce(headers.auth_summary.dmarc.pass)
Inspects: attachments[].file_type, headers.auth_summary.dmarc.pass, headers.reply_to, headers.reply_to[].email.email, recipients.to, recipients.to[0].email.domain.valid, recipients.to[0].email.email, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, ml.nlu_classifier, strings.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
headers.reply_to[].email.email | equals | |
attachments[].file_type | equals | pdf |
ml.nlu_classifier(file.explode(attachments[])[].scan.strings.raw).intents[].name | equals | cred_theft |
ml.nlu_classifier(file.explode(attachments[])[].scan.strings.raw).intents[].confidence | equals | high |