Detection rules › Sublime MQL
Attachment: PDF With SAI Global ISO9001 Logo
Detects PDF attachments containing embedded SAI Global ISO9001 logos, which may indicate brand impersonation or fraudulent certification claims.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, PDF |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(attachments, .file_type == "pdf"),
any(file.explode(.),
any(.scan.yara.matches,
// yara rule matches on an embedded SAI Global logo that allows for resized versions of the image
.name == "SAI_Global_ISO9001_Logo_PDF_Fuzzy"
)
)
)
Detection logic
Scope: inbound message.
Detects PDF attachments containing embedded SAI Global ISO9001 logos, which may indicate brand impersonation or fraudulent certification claims.
- inbound message
any of
filter(attachments)where:any of
file.explode(.)where:any of
.scan.yara.matcheswhere:- .name is 'SAI_Global_ISO9001_Logo_PDF_Fuzzy'
Inspects: attachments[].file_type, type.inbound. Sensors: file.explode.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
file.explode(filter(attachments)[])[].scan.yara.matches[].name | equals | SAI_Global_ISO9001_Logo_PDF_Fuzzy |