Detection rules › Sublime MQL
Attachment: QR code link with base64-encoded recipient address
Detects when an image or macro attachment contains QR codes that, when scanned, lead to URLs containing the recipient's email address. This tactic is used to uniquely track or target specific recipients and serve tailored credential phishing pages.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | QR code, Image as content, Social engineering, Evasion, PDF, Macros |
Event coverage
Rule body MQL
type.inbound
and 1 of (
any(ml.nlu_classifier(subject.subject).intents,
.name == "cred_theft" and .confidence == "high"
),
body.current_thread.text is null,
any($org_slds, strings.icontains(sender.display_name, .))
)
and any(attachments,
(
.file_type in $file_types_images
or .file_extension in $file_extensions_macros
or .file_type == "pdf"
)
and any(file.explode(.),
any(recipients.to,
.email.domain.valid
and any(beta.scan_base64(..scan.qr.url.url,
format="url",
ignore_padding=true
),
strings.icontains(., ..email.email)
)
)
)
)
Detection logic
Scope: inbound message.
Detects when an image or macro attachment contains QR codes that, when scanned, lead to URLs containing the recipient's email address. This tactic is used to uniquely track or target specific recipients and serve tailored credential phishing pages.
- inbound message
at least 1 of:
any of
ml.nlu_classifier(subject.subject).intentswhere all hold:- .name is 'cred_theft'
- .confidence is 'high'
- body.current_thread.text is missing
any of
$org_sldswhere:- strings.icontains(sender.display_name)
any of
attachmentswhere all hold:any of:
- .file_type in $file_types_images
- .file_extension in $file_extensions_macros
- .file_type is 'pdf'
any of
file.explode(.)where:any of
recipients.towhere all hold:- .email.domain.valid
any of
beta.scan_base64(.scan.qr.url.url)where:- strings.icontains(.)
Inspects: attachments[].file_extension, attachments[].file_type, body.current_thread.text, recipients.to, recipients.to[].email.domain.valid, recipients.to[].email.email, sender.display_name, subject.subject, type.inbound. Sensors: beta.scan_base64, file.explode, ml.nlu_classifier, strings.icontains. Reference lists: $file_extensions_macros, $file_types_images, $org_slds.
Indicators matched (3)
| Field | Match | Value |
|---|---|---|
ml.nlu_classifier(subject.subject).intents[].name | equals | cred_theft |
ml.nlu_classifier(subject.subject).intents[].confidence | equals | high |
attachments[].file_type | equals | pdf |