Detection rules › Sublime MQL
Attachment: PDF with password in filename matching body text
Detects messages containing a single PDF attachment where the filename includes a numeric password that is explicitly referenced in the message body text.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware, Credential Phishing |
| Tactics and techniques | Encryption, Evasion, PDF |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| body.current_thread |
| type |
Rule body MQL
type.inbound
and length(filter(attachments, .file_type == "pdf")) == 1
and any(regex.extract(body.current_thread.text, 'password is (?P<pw>[0-9]{1,})'),
any(filter(attachments, .file_type == "pdf"),
strings.contains(.file_name, ..named_groups["pw"])
)
)
Detection logic
Scope: inbound message.
Detects messages containing a single PDF attachment where the filename includes a numeric password that is explicitly referenced in the message body text.
- inbound message
- length(filter(attachments, .file_type == 'pdf')) is 1
any of
regex.extract(body.current_thread.text)where:any of
filter(attachments)where:- strings.contains(.file_name)
Inspects: attachments[].file_type, body.current_thread.text, type.inbound. Sensors: regex.extract, strings.contains.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
regex.extract | regex | password is (?P<pw>[0-9]{1,}) |