Detection rules › Sublime MQL
Attachment: PDF file with link to fake Bitcoin exchange
Fraudulent message containing a PDF notification of unclaimed Bitcoin assets. The PDF file contains a link to a fake Cryptocurrency portal. Attempting to withdraw funds prompts the user to enter payment information.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Free email provider, Impersonation: Brand, PDF, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
and sender.email.domain.root_domain in $free_email_providers
and length(attachments) == 1
and all(attachments,
.file_extension == "pdf"
and regex.icontains(.file_name, '(\d\.\d{3,4}.{0,12}BTC|bitcoin)')
and any(file.explode(.),
.scan.exiftool.page_count >= 5
and .depth == 0
and length(filter(.scan.strings.strings,
regex.match(., '^\/URI \(http.*')
)
) == 1
)
)
Detection logic
Scope: inbound message.
Fraudulent message containing a PDF notification of unclaimed Bitcoin assets. The PDF file contains a link to a fake Cryptocurrency portal. Attempting to withdraw funds prompts the user to enter payment information.
- inbound message
- sender.email.domain.root_domain in $free_email_providers
- length(attachments) is 1
all of
attachmentswhere all hold:- .file_extension is 'pdf'
- .file_name matches '(\\d\\.\\d{3,4}.{0,12}BTC|bitcoin)'
any of
file.explode(.)where all hold:- .scan.exiftool.page_count ≥ 5
- .depth is 0
- length(filter(.scan.strings.strings, regex.match(., '^\\/URI \\(http.*'))) is 1
Inspects: attachments[].file_extension, attachments[].file_name, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, regex.icontains, regex.match. Reference lists: $free_email_providers.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | equals | pdf |
regex.icontains | regex | (\d\.\d{3,4}.{0,12}BTC|bitcoin) |
regex.match | regex | ^\/URI \(http.* |