Detection rules › Sublime MQL
Attachment: PDF with QR code containing recipient-specific credential theft content
Detects PDF attachments containing QR codes that include the recipient's email address (either plaintext or base64 encoded) combined with credential theft language detected through natural language processing. This technique personalizes the attack by incorporating the target's email into the QR code URL while using PDF content to establish credibility.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | PDF, QR code, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| recipients |
| recipients.to (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(attachments, .file_type == "pdf"),
( // the strings produced by the PDF scanner contains cred theft language
any(filter(file.explode(.), .depth == 1 and .file_name == "text"),
any(ml.nlu_classifier(.scan.strings.raw).intents,
.name == "cred_theft"
)
)
)
// there is a QR code
and length(beta.scan_qr(.).items) > 0
// QR code contians the recipient email
and any(beta.scan_qr(.).items,
.url.domain.valid
and any(recipients.to,
.email.domain.valid
// QR code contains the email
and (
strings.icontains(..url.url, .email.email)
// QR code contains the base64 endcoded email
or any(strings.scan_base64(..url.url,
format="url",
ignore_padding=true
),
strings.icontains(., ..email.email)
)
)
)
)
)
Detection logic
Scope: inbound message.
Detects PDF attachments containing QR codes that include the recipient's email address (either plaintext or base64 encoded) combined with credential theft language detected through natural language processing. This technique personalizes the attack by incorporating the target's email into the QR code URL while using PDF content to establish credibility.
- inbound message
any of
filter(attachments)where all hold:any of
filter(...)where:any of
ml.nlu_classifier(.scan.strings.raw).intentswhere:- .name is 'cred_theft'
- length(beta.scan_qr(.).items) > 0
any of
beta.scan_qr(.).itemswhere all hold:- .url.domain.valid
any of
recipients.towhere all hold:- .email.domain.valid
any of:
- strings.icontains(.url.url)
any of
strings.scan_base64(.url.url)where:- strings.icontains(.)
Inspects: attachments[].file_type, recipients.to, recipients.to[].email.domain.valid, recipients.to[].email.email, type.inbound. Sensors: beta.scan_qr, file.explode, ml.nlu_classifier, strings.icontains, strings.scan_base64.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
file.explode(filter(attachments)[])[].file_name | equals | text |
ml.nlu_classifier(filter(...)[].scan.strings.raw).intents[].name | equals | cred_theft |