Detection rules › Sublime MQL
Attachment: PDF with suspicious HeadlessChrome metadata
Detects PDF attachments created by HeadlessChrome with suspicious characteristics, including MD5-formatted HTML filenames or blank titles with Windows Skia/PDF producer, excluding legitimate Google Docs files.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion, PDF |
Event coverage
Rule body MQL
type.inbound
and any(filter(attachments, .file_extension == "pdf"),
strings.icontains(beta.parse_exif(.).creator, "HeadlessChrome")
and beta.parse_exif(.).page_count == 1
and (
// MD5 filename, 32 hex chars and .html
(
regex.imatch(beta.parse_exif(.).title, '^[a-f0-9]{32}\.html$')
or
// about:blank and Windows HeadlessChrome
(
beta.parse_exif(.).title == "about:blank"
and strings.istarts_with(beta.parse_exif(.).producer, "Skia/PDF")
and strings.icontains(beta.parse_exif(.).creator, "Windows")
)
// cred theft intents on the message and Windows Headless Chrome
or (
any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "cred_theft" and .confidence != "low"
)
and strings.istarts_with(beta.parse_exif(.).producer, "Skia/PDF")
and strings.icontains(beta.parse_exif(.).creator, "Windows")
)
)
and not strings.icontains(beta.parse_exif(.).producer, "Google Docs")
)
)
and not (
sender.email.domain.root_domain in (
"guardtek.net",
"gominis.com",
"aglgroup.com",
"truckerzoom.com"
)
and coalesce(headers.auth_summary.dmarc.pass, false)
)
Detection logic
Scope: inbound message.
Detects PDF attachments created by HeadlessChrome with suspicious characteristics, including MD5-formatted HTML filenames or blank titles with Windows Skia/PDF producer, excluding legitimate Google Docs files.
- inbound message
any of
filter(attachments)where all hold:- beta.parse_exif(.).creator contains 'HeadlessChrome'
- beta.parse_exif(.).page_count is 1
all of:
any of:
- beta.parse_exif(.).title matches '^[a-f0-9]{32}\\.html$'
all of:
- beta.parse_exif(.).title is 'about:blank'
- beta.parse_exif(.).producer starts with 'Skia/PDF'
- beta.parse_exif(.).creator contains 'Windows'
all of:
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name is 'cred_theft'
- .confidence is not 'low'
- beta.parse_exif(.).producer starts with 'Skia/PDF'
- beta.parse_exif(.).creator contains 'Windows'
not:
- beta.parse_exif(.).producer contains 'Google Docs'
not:
all of:
- sender.email.domain.root_domain in ('guardtek.net', 'gominis.com', 'aglgroup.com', 'truckerzoom.com')
- coalesce(headers.auth_summary.dmarc.pass)
Inspects: attachments[].file_extension, body.current_thread.text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: beta.parse_exif, ml.nlu_classifier, regex.imatch, strings.icontains, strings.istarts_with.
Indicators matched (11)
| Field | Match | Value |
|---|---|---|
attachments[].file_extension | equals | pdf |
strings.icontains | substring | HeadlessChrome |
regex.imatch | regex | ^[a-f0-9]{32}\.html$ |
strings.istarts_with | prefix | Skia/PDF |
strings.icontains | substring | Windows |
ml.nlu_classifier(body.current_thread.text).intents[].name | equals | cred_theft |
strings.icontains | substring | Google Docs |
sender.email.domain.root_domain | member | guardtek.net |
sender.email.domain.root_domain | member | gominis.com |
sender.email.domain.root_domain | member | aglgroup.com |
sender.email.domain.root_domain | member | truckerzoom.com |