Detection rules › Sublime MQL

Attachment: PDF with suspicious HeadlessChrome metadata

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects PDF attachments created by HeadlessChrome with suspicious characteristics, including MD5-formatted HTML filenames or blank titles with Windows Skia/PDF producer, excluding legitimate Google Docs files.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesEvasion, PDF

Event coverage

Rule body MQL

type.inbound
and any(filter(attachments, .file_extension == "pdf"),
        strings.icontains(beta.parse_exif(.).creator, "HeadlessChrome")
        and beta.parse_exif(.).page_count == 1
        and (
          // MD5 filename, 32 hex chars and .html
          (
            regex.imatch(beta.parse_exif(.).title, '^[a-f0-9]{32}\.html$')
            or 
            // about:blank and Windows HeadlessChrome
            (
              beta.parse_exif(.).title == "about:blank"
              and strings.istarts_with(beta.parse_exif(.).producer, "Skia/PDF")
              and strings.icontains(beta.parse_exif(.).creator, "Windows")
            )
            // cred theft intents on the message and Windows Headless Chrome
            or (
              any(ml.nlu_classifier(body.current_thread.text).intents,
                  .name == "cred_theft" and .confidence != "low"
              )
              and strings.istarts_with(beta.parse_exif(.).producer, "Skia/PDF")
              and strings.icontains(beta.parse_exif(.).creator, "Windows")
            )
          )
          and not strings.icontains(beta.parse_exif(.).producer, "Google Docs")
        )
)
and not (
  sender.email.domain.root_domain in (
    "guardtek.net",
    "gominis.com",
    "aglgroup.com",
    "truckerzoom.com"
  )
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Detection logic

Scope: inbound message.

Detects PDF attachments created by HeadlessChrome with suspicious characteristics, including MD5-formatted HTML filenames or blank titles with Windows Skia/PDF producer, excluding legitimate Google Docs files.

  1. inbound message
  2. any of filter(attachments) where all hold:
    • beta.parse_exif(.).creator contains 'HeadlessChrome'
    • beta.parse_exif(.).page_count is 1
    • all of:
      • any of:
        • beta.parse_exif(.).title matches '^[a-f0-9]{32}\\.html$'
        • all of:
          • beta.parse_exif(.).title is 'about:blank'
          • beta.parse_exif(.).producer starts with 'Skia/PDF'
          • beta.parse_exif(.).creator contains 'Windows'
        • all of:
          • any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
            • .name is 'cred_theft'
            • .confidence is not 'low'
          • beta.parse_exif(.).producer starts with 'Skia/PDF'
          • beta.parse_exif(.).creator contains 'Windows'
      • not:
        • beta.parse_exif(.).producer contains 'Google Docs'
  3. not:
    • all of:
      • sender.email.domain.root_domain in ('guardtek.net', 'gominis.com', 'aglgroup.com', 'truckerzoom.com')
      • coalesce(headers.auth_summary.dmarc.pass)

Inspects: attachments[].file_extension, body.current_thread.text, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: beta.parse_exif, ml.nlu_classifier, regex.imatch, strings.icontains, strings.istarts_with.

Indicators matched (11)

FieldMatchValue
attachments[].file_extensionequalspdf
strings.icontainssubstringHeadlessChrome
regex.imatchregex^[a-f0-9]{32}\.html$
strings.istarts_withprefixSkia/PDF
strings.icontainssubstringWindows
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscred_theft
strings.icontainssubstringGoogle Docs
sender.email.domain.root_domainmemberguardtek.net
sender.email.domain.root_domainmembergominis.com
sender.email.domain.root_domainmemberaglgroup.com
sender.email.domain.root_domainmembertruckerzoom.com