Detection rules › Sublime MQL
Extortion / Sextortion - PDF attachment leveraging breach data from freemail sender
Detects sextortion attempts leveraging breach data, including names, addresses, phone numbers and frequently using Google Maps/Bing Maps streetview images to bolster confidence and fear.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Free email provider, PDF, Social engineering, QR code |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| body.current_thread |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
// sender is a freemail domain
and sender.email.domain.root_domain in $free_email_providers
// attachment filename is the same as the subject
and any(attachments,
(
strings.ilevenshtein(strings.concat(subject.subject,
".",
.file_extension
),
.file_name
) <= 1
)
or strings.contains(.file_name, subject.subject)
)
// body contains a US address, or the body is the subject
and (
regex.icontains(body.current_thread.text,
'\d+\s[\w\s.]+(?:\n)?[\w\s]+\s[A-Z]{2}\s\d{5}(?:-\d{4})?(?:\n)?|\d+\s[\w\s.]+(?:Street|St|Avenue|Ave|Boulevard|Blvd|Road|Rd|Drive|Dr|Lane|Ln|Court|Ct|Way|Place|Pl|Terrace|Ter|Circle|Cir|Parkway|Pkwy|Trail|Trl|Highway|Hwy|Loop)\b\.?',
// a Canadian address
'\d+\s[\w\s.]+(?:\n)?[\w\s]+\s((?:Ontario|ON)|(?:Quebec|QC)|(?:Nova Scotia|NS)|(?:New Brunswick|NB)|(?:Manitoba|MB)|(?:British Columbia|BC)|(?:Prince Edward Island|PEI?)|(?:Saskatchewan|SK)|(?:Alberta|AB)|(?:Newfoundland and Labrador|NL)|(?:Yukon|YT)|(?:Northwest Territories|NT)|(?:Nunavut|NU))\s*[ABCEGHJ-NPRSTVXY]\d[ABCEGHJ-NPRSTV-Z][ -]?\d[ABCEGHJ-NPRSTV-Z]\d'
)
or subject.subject == body.current_thread.text
)
// there's a PDF attachment with an image at a depth of one, measuring 148x148 and containing a QR code that is a BTC address
and any(attachments,
.file_type == "pdf"
and any(file.explode(.),
(
(.depth == 1 and .flavors.mime == "image/jpeg")
and (
.scan.exiftool.image_height == 148
and .scan.exiftool.image_width == 148
and regex.match(.scan.qr.data,
'(1[a-km-zA-HJ-NP-Z1-9]{25,34}|3[a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[qp-z0-9]{39,59})'
)
)
)
or (
any(.scan.strings.strings,
regex.icontains(.,
'Amount(?:\s*\w+){0,3}\s*:?\s*(?:USD\s*)?(?:\$\s?\d+|\d+\s?\$?)'
)
)
and any(.scan.strings.strings,
regex.icontains(.,
'(\bBITCOIN\b|\bBTC\b|\bLTC\b|Wallet)'
)
)
)
)
)
Detection logic
Scope: inbound message.
Detects sextortion attempts leveraging breach data, including names, addresses, phone numbers and frequently using Google Maps/Bing Maps streetview images to bolster confidence and fear.
- inbound message
- sender.email.domain.root_domain in $free_email_providers
any of
attachmentswhere any holds:- strings.ilevenshtein(strings.concat(subject.subject, '.', .file_extension)) ≤ 1
- strings.contains(.file_name)
any of:
body.current_thread.text matches any of 2 patterns
\d+\s[\w\s.]+(?:\n)?[\w\s]+\s[A-Z]{2}\s\d{5}(?:-\d{4})?(?:\n)?|\d+\s[\w\s.]+(?:Street|St|Avenue|Ave|Boulevard|Blvd|Road|Rd|Drive|Dr|Lane|Ln|Court|Ct|Way|Place|Pl|Terrace|Ter|Circle|Cir|Parkway|Pkwy|Trail|Trl|Highway|Hwy|Loop)\b\.?\d+\s[\w\s.]+(?:\n)?[\w\s]+\s((?:Ontario|ON)|(?:Quebec|QC)|(?:Nova Scotia|NS)|(?:New Brunswick|NB)|(?:Manitoba|MB)|(?:British Columbia|BC)|(?:Prince Edward Island|PEI?)|(?:Saskatchewan|SK)|(?:Alberta|AB)|(?:Newfoundland and Labrador|NL)|(?:Yukon|YT)|(?:Northwest Territories|NT)|(?:Nunavut|NU))\s*[ABCEGHJ-NPRSTVXY]\d[ABCEGHJ-NPRSTV-Z][ -]?\d[ABCEGHJ-NPRSTV-Z]\d
- subject.subject is body.current_thread.text
any of
attachmentswhere all hold:- .file_type is 'pdf'
any of
file.explode(.)where any holds:all of:
all of:
- .depth is 1
- .flavors.mime is 'image/jpeg'
all of:
- .scan.exiftool.image_height is 148
- .scan.exiftool.image_width is 148
- .scan.qr.data matches '(1[a-km-zA-HJ-NP-Z1-9]{25,34}|3[a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[qp-z0-9]{39,59})'
all of:
any of
.scan.strings.stringswhere:- . matches 'Amount(?:\\s*\\w+){0,3}\\s*:?\\s*(?:USD\\s*)?(?:\\$\\s?\\d+|\\d+\\s?\\$?)'
any of
.scan.strings.stringswhere:- . matches '(\\bBITCOIN\\b|\\bBTC\\b|\\bLTC\\b|Wallet)'
Inspects: attachments[].file_extension, attachments[].file_name, attachments[].file_type, body.current_thread.text, sender.email.domain.root_domain, subject.subject, type.inbound. Sensors: file.explode, regex.icontains, regex.match, strings.concat, strings.contains, strings.ilevenshtein. Reference lists: $free_email_providers.
Indicators matched (7)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | \d+\s[\w\s.]+(?:\n)?[\w\s]+\s[A-Z]{2}\s\d{5}(?:-\d{4})?(?:\n)?|\d+\s[\w\s.]+(?:Street|St|Avenue|Ave|Boulevard|Blvd|Road|Rd|Drive|Dr|Lane|Ln|Court|Ct|Way|Place|Pl|Terrace|Ter|Circle|Cir|Parkway|Pkwy|Trail|Trl|Highway|Hwy|Loop)\b\.? |
regex.icontains | regex | \d+\s[\w\s.]+(?:\n)?[\w\s]+\s((?:Ontario|ON)|(?:Quebec|QC)|(?:Nova Scotia|NS)|(?:New Brunswick|NB)|(?:Manitoba|MB)|(?:British Columbia|BC)|(?:Prince Edward Island|PEI?)|(?:Saskatchewan|SK)|(?:Alberta|AB)|(?:Newfoundland and Labrador|NL)|(?:Yukon|YT)|(?:Northwest Territories|NT)|(?:Nunavut|NU))\s*[ABCEGHJ-NPRSTVXY]\d[ABCEGHJ-NPRSTV-Z][ -]?\d[ABCEGHJ-NPRSTV-Z]\d |
attachments[].file_type | equals | pdf |
file.explode(attachments[])[].flavors.mime | equals | image/jpeg |
regex.match | regex | (1[a-km-zA-HJ-NP-Z1-9]{25,34}|3[a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[qp-z0-9]{39,59}) |
regex.icontains | regex | Amount(?:\s*\w+){0,3}\s*:?\s*(?:USD\s*)?(?:\$\s?\d+|\d+\s?\$?) |
regex.icontains | regex | (\bBITCOIN\b|\bBTC\b|\bLTC\b|Wallet) |