Detection rules › Sublime MQL
Attachment: PDF with personal Microsoft OneNote URL
Detects PDF attachments containing a sharepoint URL referencing the senders personal OneNote.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | PDF, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
and length(filter(attachments, .file_type == "pdf")) >= 1
and any(attachments,
.file_type == "pdf"
and any(file.explode(.),
any(.scan.url.urls,
strings.icontains(.path,
strings.concat("/:o:/p/",
sender.email.local_part
)
)
or strings.icontains(.path, "/:o:/g/personal/")
)
)
)
Detection logic
Scope: inbound message.
Detects PDF attachments containing a sharepoint URL referencing the senders personal OneNote.
- inbound message
- length(filter(attachments, .file_type == 'pdf')) ≥ 1
any of
attachmentswhere all hold:- .file_type is 'pdf'
any of
file.explode(.)where:any of
.scan.url.urlswhere any holds:- strings.icontains(.path)
- .path contains '/:o:/g/personal/'
Inspects: attachments[].file_type, sender.email.local_part, type.inbound. Sensors: file.explode, strings.concat, strings.icontains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
strings.icontains | substring | /:o:/g/personal/ |