Detection rules › Sublime MQL

Attachment: PDF with split QR code

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects PDF attachments containing split QR codes positioned close together, a technique used to evade detection while maintaining QR code functionality for credential theft.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesEvasion, PDF, QR code

Event coverage

Rule body MQL

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            any(.scan.yara.matches,
                // yara rules match on "split" QR codes that are 290x290, 300x300, 370x370 and placed close to eachtoher in the PDF
                strings.istarts_with(.name, 'Phishing_PDF_Split_QR_Code_Pair')
            )
        )
)

Detection logic

Scope: inbound message.

Detects PDF attachments containing split QR codes positioned close together, a technique used to evade detection while maintaining QR code functionality for credential theft.

  1. inbound message
  2. any of filter(attachments) where:
    • any of file.explode(.) where:
      • any of .scan.yara.matches where:
        • .name starts with 'Phishing_PDF_Split_QR_Code_Pair'

Inspects: attachments[].file_type, type.inbound. Sensors: file.explode, strings.istarts_with.

Indicators matched (2)

FieldMatchValue
attachments[].file_typeequalspdf
strings.istarts_withprefixPhishing_PDF_Split_QR_Code_Pair