Detection rules › Sublime MQL
Attachment: PDF with suspicious link and action-oriented language
Detects PDF attachments containing a single link that leads to pages with language prompting users to view, review, or read documents, accounts, or business-related content such as bids, proposals, agreements, or contracts.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | PDF, Social engineering, Evasion |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and length(filter(attachments, .file_type == "pdf")) >= 1
and any(attachments,
.file_type == "pdf"
and beta.parse_exif(.).page_count == 1
and any(file.explode(.),
.depth == 0
// reduce fps by limiting the length to a single link
and length(.scan.url.urls) == 1
and any(filter(.scan.url.urls,
// remove mailto: links
not strings.istarts_with(.url, 'mailto:')
and not strings.istarts_with(.url, 'email:')
// remove links found in exiftool output
and not (
..scan.exiftool.producer is not null
and strings.icontains(..scan.exiftool.producer,
.domain.domain
)
)
// remove links found in exiftool output
and not (
..scan.exiftool.creator is not null
and strings.icontains(..scan.exiftool.creator,
.domain.domain
)
)
and not .domain.root_domain in ('pdf-tools.com')
),
(
200 <= ml.link_analysis(.).status_code < 300
and length(ml.link_analysis(.).final_dom.links) < 100
and any(ml.link_analysis(.).final_dom.links,
.href_url.domain.root_domain != ..domain.root_domain
and regex.icontains(.display_text,
'\b(?:(?:re)?view|see|read|click\s+(?:here\s+)?to)[\t\x20]*(?:\S+[\t\x20]*){0,3}[\t\x20]*(?:document|message|now|proceed)',
'\b(?:request|review)\b.{1,5}\b(?:bid|proposal|agreement|portfolio|contract|settlement|invoice)\b',
)
)
)
or (
200 <= ml.link_analysis(.).status_code < 300
and length(ml.link_analysis(.).final_dom.display_text) < 1050
and regex.icontains(ml.link_analysis(.).final_dom.display_text,
'\b(?:(?:re)?view|see|read|click\s+(?:here\s+)?to)[\t\x20]*(?:\S+[\t\x20]*){0,3}[\t\x20]*(?:document|message|now|proceed)',
'\b(?:request|review)\b.{1,5}\b(?:bid|proposal|agreement|portfolio|contract|settlement|invoice)\b'
)
// a common fp in the .au for a payment system
and not strings.icontains(ml.link_analysis(.).final_dom.display_text,
'View Podium Message'
)
)
// the title contains high confidence indicators
or any(html.xpath(ml.link_analysis(.).final_dom,
'//title'
).nodes,
strings.icontains(.raw, 'Secure Document')
)
)
)
)
Detection logic
Scope: inbound message.
Detects PDF attachments containing a single link that leads to pages with language prompting users to view, review, or read documents, accounts, or business-related content such as bids, proposals, agreements, or contracts.
- inbound message
- length(filter(attachments, .file_type == 'pdf')) ≥ 1
any of
attachmentswhere all hold:- .file_type is 'pdf'
- beta.parse_exif(.).page_count is 1
any of
file.explode(.)where all hold:- .depth is 0
- length(.scan.url.urls) is 1
any of
filter(.scan.url.urls)where any holds:all of:
all of:
- ml.link_analysis(.).status_code ≥ 200
- ml.link_analysis(.).status_code < 300
- length(ml.link_analysis(.).final_dom.links) < 100
any of
ml.link_analysis(.).final_dom.linkswhere all hold:- .href_url.domain.root_domain is not .domain.root_domain
.display_text matches any of 2 patterns
\b(?:(?:re)?view|see|read|click\s+(?:here\s+)?to)[\t\x20]*(?:\S+[\t\x20]*){0,3}[\t\x20]*(?:document|message|now|proceed)\b(?:request|review)\b.{1,5}\b(?:bid|proposal|agreement|portfolio|contract|settlement|invoice)\b
all of:
all of:
- ml.link_analysis(.).status_code ≥ 200
- ml.link_analysis(.).status_code < 300
- length(ml.link_analysis(.).final_dom.display_text) < 1050
ml.link_analysis(.).final_dom.display_text matches any of 2 patterns
\b(?:(?:re)?view|see|read|click\s+(?:here\s+)?to)[\t\x20]*(?:\S+[\t\x20]*){0,3}[\t\x20]*(?:document|message|now|proceed)\b(?:request|review)\b.{1,5}\b(?:bid|proposal|agreement|portfolio|contract|settlement|invoice)\b
not:
- ml.link_analysis(.).final_dom.display_text contains 'View Podium Message'
any of
html.xpath(ml.link_analysis(.).final_dom, '//title').nodeswhere:- .raw contains 'Secure Document'
Inspects: attachments[].file_type, type.inbound. Sensors: beta.parse_exif, file.explode, html.xpath, ml.link_analysis, regex.icontains, strings.icontains, strings.istarts_with.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
strings.istarts_with | prefix | mailto: |
strings.istarts_with | prefix | email: |
file.explode(attachments[])[].scan.url.urls[].domain.root_domain | member | pdf-tools.com |
regex.icontains | regex | \b(?:(?:re)?view|see|read|click\s+(?:here\s+)?to)[\t\x20]*(?:\S+[\t\x20]*){0,3}[\t\x20]*(?:document|message|now|proceed) |
regex.icontains | regex | \b(?:request|review)\b.{1,5}\b(?:bid|proposal|agreement|portfolio|contract|settlement|invoice)\b |
strings.icontains | substring | View Podium Message |
strings.icontains | substring | Secure Document |