Detection rules › Sublime MQL
Attachment: Self-sender PDF with minimal content and view prompt
Detects messages where the sender and recipient are the same address with a PDF attachment containing only 'VIEW PDF' text and a standardized body message requesting to view the attachment.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | PDF, Social engineering, Evasion |
Event coverage
Rule body MQL
type.inbound
// self sender
and length(recipients.to) == 1
and (
sender.email.email == recipients.to[0].email.email
or recipients.to[0].email.domain.valid == false
)
and strings.starts_with(body.current_thread.text, 'Please see attached')
and any(filter(attachments, .file_type == 'pdf'),
any(file.explode(.),
.scan.strings.strings[0] == 'VIEW PDF'
and length(.scan.strings.strings) == 1
)
)
Detection logic
Scope: inbound message.
Detects messages where the sender and recipient are the same address with a PDF attachment containing only 'VIEW PDF' text and a standardized body message requesting to view the attachment.
- inbound message
- length(recipients.to) is 1
any of:
- sender.email.email is recipients.to[0].email.email
- recipients.to[0].email.domain.valid is False
- body.current_thread.text starts with 'Please see attached'
any of
filter(attachments)where:any of
file.explode(.)where all hold:- .scan.strings.strings[0] is 'VIEW PDF'
- length(.scan.strings.strings) is 1
Inspects: attachments[].file_type, body.current_thread.text, recipients.to, recipients.to[0].email.domain.valid, recipients.to[0].email.email, sender.email.email, type.inbound. Sensors: file.explode, strings.starts_with.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
strings.starts_with | prefix | Please see attached |
attachments[].file_type | equals | pdf |
file.explode(filter(attachments)[])[].scan.strings.strings[0] | equals | VIEW PDF |