Detection rules › Sublime MQL
Attachment: PDF contains W9 or invoice YARA signatures
PDF attachment contains YARA signatures commonly associated with fraudulent W9 tax forms or invoice documents, which are frequently used in social engineering attacks to steal sensitive information or facilitate business email compromise.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | PDF, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(attachments, .file_type == "pdf"),
any(file.explode(.),
any(.scan.yara.matches,
.name in ("w9_pdf_01", "invoice_pdf_01", "w9_pdf_IDs")
)
)
)
Detection logic
Scope: inbound message.
PDF attachment contains YARA signatures commonly associated with fraudulent W9 tax forms or invoice documents, which are frequently used in social engineering attacks to steal sensitive information or facilitate business email compromise.
- inbound message
any of
filter(attachments)where:any of
file.explode(.)where:any of
.scan.yara.matcheswhere:- .name in ('w9_pdf_01', 'invoice_pdf_01', 'w9_pdf_IDs')
Inspects: attachments[].file_type, type.inbound. Sensors: file.explode.
Indicators matched (4)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
file.explode(filter(attachments)[])[].scan.yara.matches[].name | member | w9_pdf_01 |
file.explode(filter(attachments)[])[].scan.yara.matches[].name | member | invoice_pdf_01 |
file.explode(filter(attachments)[])[].scan.yara.matches[].name | member | w9_pdf_IDs |