Detection rules › Sublime MQL
Attachment: PDF with self-service platform links with self sender or blank recipients
Detects single-page PDF attachments containing links to self-service content creation platforms, sent to either the sender's own email address or an invalid email domain. This pattern may indicate testing of malicious content or preparation for distribution.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | PDF, Evasion, Free file host |
Event coverage
Rule body MQL
type.inbound
and sum([length(recipients.to), length(recipients.cc)]) == 1
and (
sender.email.email == recipients.to[0].email.email
or recipients.to[0].email.domain.valid == false
)
and length(attachments) == 1
and beta.parse_exif(attachments[0]).page_count == 1
and any(filter(attachments, .file_type == "pdf"),
any(filter(file.explode(.), .depth == 0),
1 <= length(filter(.scan.url.urls,
// remove mailto: links
not strings.istarts_with(.url, 'mailto:')
and not strings.istarts_with(.url, 'email:')
// remove links found in exiftool output producer/creator
and not any([
..scan.exiftool.producer,
..scan.exiftool.creator
],
. is not null
and strings.icontains(.,
..domain.domain
)
)
and not .domain.root_domain in ('pdf-tools.com')
and not .url in (
'https://gamma.app/?utm_source=made-with-gamma'
)
)
) <= 3
and all(.scan.url.urls,
.domain.root_domain in $self_service_creation_platform_domains
or .domain.domain in $self_service_creation_platform_domains
)
)
)
Detection logic
Scope: inbound message.
Detects single-page PDF attachments containing links to self-service content creation platforms, sent to either the sender's own email address or an invalid email domain. This pattern may indicate testing of malicious content or preparation for distribution.
- inbound message
- sum([length(recipients.to), length(recipients.cc)]) is 1
any of:
- sender.email.email is recipients.to[0].email.email
- recipients.to[0].email.domain.valid is False
- length(attachments) is 1
- beta.parse_exif(attachments[0]).page_count is 1
any of
filter(attachments)where:any of
filter(...)where all hold:all of:
- length(filter(.scan.url.urls, not strings.istarts_with(.url, 'mailto:') and not strings.istarts_with(.url, 'email:') and not any([.scan.exiftool.producer, .scan.exiftool.creator], . is not null and strings.icontains(., .domain.domain)) and not .domain.root_domain in ('pdf-tools.com') and not .url in ('https://gamma.app/?utm_source=made-with-gamma'))) ≥ 1
- length(filter(.scan.url.urls, not strings.istarts_with(.url, 'mailto:') and not strings.istarts_with(.url, 'email:') and not any([.scan.exiftool.producer, .scan.exiftool.creator], . is not null and strings.icontains(., .domain.domain)) and not .domain.root_domain in ('pdf-tools.com') and not .url in ('https://gamma.app/?utm_source=made-with-gamma'))) ≤ 3
all of
.scan.url.urlswhere any holds:- .domain.root_domain in $self_service_creation_platform_domains
- .domain.domain in $self_service_creation_platform_domains
Inspects: attachments[0], attachments[].file_type, recipients.cc, recipients.to, recipients.to[0].email.domain.valid, recipients.to[0].email.email, sender.email.email, type.inbound. Sensors: beta.parse_exif, file.explode, strings.icontains, strings.istarts_with. Reference lists: $self_service_creation_platform_domains.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
strings.istarts_with | prefix | mailto: |
strings.istarts_with | prefix | email: |
filter(...)[].scan.url.urls[].domain.root_domain | member | pdf-tools.com |
filter(...)[].scan.url.urls[].url | member | https://gamma.app/?utm_source=made-with-gamma |