Detection rules › Sublime MQL

Attachment: PDF contains W9 or invoice YARA signatures

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

PDF attachment contains YARA signatures commonly associated with fraudulent W9 tax forms or invoice documents, which are frequently used in social engineering attacks to steal sensitive information or facilitate business email compromise.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesBEC/Fraud, Credential Phishing
Tactics and techniquesPDF, Social engineering

Event coverage

Rule body MQL

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            any(.scan.yara.matches,
                .name in ("w9_pdf_01", "invoice_pdf_01", "w9_pdf_IDs")
            )
        )
)

Detection logic

Scope: inbound message.

PDF attachment contains YARA signatures commonly associated with fraudulent W9 tax forms or invoice documents, which are frequently used in social engineering attacks to steal sensitive information or facilitate business email compromise.

  1. inbound message
  2. any of filter(attachments) where:
    • any of file.explode(.) where:
      • any of .scan.yara.matches where:
        • .name in ('w9_pdf_01', 'invoice_pdf_01', 'w9_pdf_IDs')

Inspects: attachments[].file_type, type.inbound. Sensors: file.explode.

Indicators matched (4)

FieldMatchValue
attachments[].file_typeequalspdf
file.explode(filter(attachments)[])[].scan.yara.matches[].namememberw9_pdf_01
file.explode(filter(attachments)[])[].scan.yara.matches[].namememberinvoice_pdf_01
file.explode(filter(attachments)[])[].scan.yara.matches[].namememberw9_pdf_IDs