Detection rules › Sublime MQL
Attachment: Password-protected PDF with fake document indicators
Detects PDF attachments that are password protected and matching YARA signatures looking for specific content observed in previous activity.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware, Credential Phishing |
| Tactics and techniques | Encryption, Evasion, PDF |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and length(attachments) == 1
and any(filter(attachments, .file_type == "pdf"),
//
// This rule makes use of a beta feature and is subject to change without notice
// using the beta featuer in custom rules is not suggested until it has been formally released.
//
any(beta.parse_exif(.).fields,
strings.icontains(.value, 'password protected')
)
and any(file.explode(.),
any(.scan.yara.matches,
.name in ("pwd_protected_pdf_fake_document_1")
)
)
)
Detection logic
Scope: inbound message.
Detects PDF attachments that are password protected and matching YARA signatures looking for specific content observed in previous activity.
- inbound message
- length(attachments) is 1
any of
filter(attachments)where all hold:any of
beta.parse_exif(.).fieldswhere:- .value contains 'password protected'
any of
file.explode(.)where:any of
.scan.yara.matcheswhere:- .name in ('pwd_protected_pdf_fake_document_1')
Inspects: attachments[].file_type, type.inbound. Sensors: beta.parse_exif, file.explode, strings.icontains.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
strings.icontains | substring | password protected |
file.explode(filter(attachments)[])[].scan.yara.matches[].name | member | pwd_protected_pdf_fake_document_1 |