Detection rules › Sublime MQL
Attachment: PDF with Microsoft Purview message impersonation
Detects PDF attachments containing text that impersonates Microsoft Purview secure message notifications, potentially used to trick users into believing they have received legitimate secure communications from Microsoft services.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, PDF, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| headers.auth_summary |
| sender.email |
| type |
Rule body MQL
type.inbound
and any(filter(attachments, .file_extension == 'pdf'),
any(ml.nlu_classifier(beta.ocr(.).text).topics,
.name == 'Secure Message' and .confidence == 'high'
)
and strings.icontains(beta.ocr(.).text, "Microsoft Purview Message")
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
Detects PDF attachments containing text that impersonates Microsoft Purview secure message notifications, potentially used to trick users into believing they have received legitimate secure communications from Microsoft services.
- inbound message
any of
filter(attachments)where all hold:any of
ml.nlu_classifier(beta.ocr(.).text).topicswhere all hold:- .name is 'Secure Message'
- .confidence is 'high'
- beta.ocr(.).text contains 'Microsoft Purview Message'
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: attachments[].file_extension, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: beta.ocr, ml.nlu_classifier, strings.icontains. Reference lists: $high_trust_sender_root_domains.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | equals | pdf |
ml.nlu_classifier(beta.ocr(filter(attachments)[]).text).topics[].name | equals | Secure Message |
ml.nlu_classifier(beta.ocr(filter(attachments)[]).text).topics[].confidence | equals | high |
strings.icontains | substring | Microsoft Purview Message |