Detection rules › Sublime MQL
PDF attachment with Google (AE) redirecting to a php or zip file
Detects a PDF attachment with a link that contains a Google.ae redirect URL.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Malware/Ransomware |
| Tactics and techniques | Open redirect, PDF |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(attachments,
.file_type == "pdf"
and any(file.explode(.),
any(.scan.pdf.urls,
// url encoded q=http
strings.starts_with(.query_params, "q=%68%74%74%70")
// url encoded .php or .zip
and (
strings.contains(.query_params, ".%70%68%70")
or strings.contains(.query_params, "%2e%7a%69%70")
)
and .domain.root_domain == "google.ae"
)
)
)
Detection logic
Scope: inbound message.
Detects a PDF attachment with a link that contains a Google.ae redirect URL.
- inbound message
any of
attachmentswhere all hold:- .file_type is 'pdf'
any of
file.explode(.)where:any of
.scan.pdf.urlswhere all hold:- .query_params starts with 'q=%68%74%74%70'
any of:
- .query_params contains '.%70%68%70'
- .query_params contains '%2e%7a%69%70'
- .domain.root_domain is 'google.ae'
Inspects: attachments[].file_type, type.inbound. Sensors: file.explode, strings.contains, strings.starts_with.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
strings.starts_with | prefix | q=%68%74%74%70 |
strings.contains | substring | .%70%68%70 |
strings.contains | substring | %2e%7a%69%70 |
file.explode(attachments[])[].scan.pdf.urls[].domain.root_domain | equals | google.ae |