detection.wiki

Detection rules › Sublime MQL

Attachment: PDF Object Hash - Encrypted PDFs with fake payment notification

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects PDF attachments containing a specific object hash (63bf167b66091a4bc53e8944a76f6b08) that may indicate malicious content or known threat indicators.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesMalware/Ransomware
Tactics and techniquesPDF, Evasion

Event coverage

Message attribute
attachments (collection)
type

Rule body MQL

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            .scan.pdf_obj_hash.object_hash == "63bf167b66091a4bc53e8944a76f6b08"
        )
)

Detection logic

Scope: inbound message.

Detects PDF attachments containing a specific object hash (63bf167b66091a4bc53e8944a76f6b08) that may indicate malicious content or known threat indicators.

  1. inbound message
  2. any of filter(attachments) where:
    • any of file.explode(.) where:
      • .scan.pdf_obj_hash.object_hash is '63bf167b66091a4bc53e8944a76f6b08'

Inspects: attachments[].file_type, type.inbound. Sensors: file.explode.

Indicators matched (2)

FieldMatchValue
attachments[].file_typeequalspdf
file.explode(filter(attachments)[])[].scan.pdf_obj_hash.object_hashequals63bf167b66091a4bc53e8944a76f6b08