Detection rules › Sublime MQL
Attachment: PDF with suspicious language and redirect to suspicious file type
Attached PDF contains credential theft language, and links to an open redirect to a suspicious file type. This has been observed in-the-wild as a Qakbot technique.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware, Credential Phishing |
| Tactics and techniques | Evasion, PDF |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
.file_type == "pdf"
and any(file.explode(.),
length(.scan.url.urls) > 0
and any(ml.nlu_classifier(.scan.ocr.raw).intents,
.name == "cred_theft"
and .confidence in~ ("medium", "high")
)
and any(.scan.url.urls,
strings.icontains(ml.link_analysis(.).final_dom.display_text,
"Redirect Notice"
)
and (
strings.contains(ml.link_analysis(.).final_dom.display_text,
".zip"
)
or strings.contains(ml.link_analysis(.).final_dom.display_text,
".php"
)
)
)
)
)
Detection logic
Scope: inbound message.
Attached PDF contains credential theft language, and links to an open redirect to a suspicious file type. This has been observed in-the-wild as a Qakbot technique.
- inbound message
any of
attachmentswhere all hold:- .file_type is 'pdf'
any of
file.explode(.)where all hold:- length(.scan.url.urls) > 0
any of
ml.nlu_classifier(.scan.ocr.raw).intentswhere all hold:- .name is 'cred_theft'
- .confidence in ('medium', 'high')
any of
.scan.url.urlswhere all hold:- ml.link_analysis(.).final_dom.display_text contains 'Redirect Notice'
any of:
- ml.link_analysis(.).final_dom.display_text contains '.zip'
- ml.link_analysis(.).final_dom.display_text contains '.php'
Inspects: attachments[].file_type, type.inbound. Sensors: file.explode, ml.link_analysis, ml.nlu_classifier, strings.contains, strings.icontains.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
ml.nlu_classifier(file.explode(attachments[])[].scan.ocr.raw).intents[].name | equals | cred_theft |
ml.nlu_classifier(file.explode(attachments[])[].scan.ocr.raw).intents[].confidence | member | medium |
ml.nlu_classifier(file.explode(attachments[])[].scan.ocr.raw).intents[].confidence | member | high |
strings.icontains | substring | Redirect Notice |
strings.contains | substring | .zip |
strings.contains | substring | .php |