Attachment: QR code with recipient targeting and special characters

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects messages with QR code in attachments containing special characters in the path that include the recipient's email address in either the URL path or fragment, potentially encoded in base64. The URLs have a simple path structure and may end with suspicious patterns.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Credential Phishing
Tactics and techniques	QR code, Social engineering, Evasion

Event coverage

Message attribute
attachments (collection)
recipients
recipients.to (collection)
type

Rule body MQL

type.inbound
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(attachments,
        (
          // Office documents
          .file_extension in $file_extensions_macros
          and any(file.explode(.),
                  .scan.qr.type == "url"
                  // QR code URL contains recipient's email (targeting indicator)
                  and any(recipients.to,
                          .email.domain.valid
                          and (
                            // Plaintext email address in URL
                            strings.icontains(..scan.qr.url.url, .email.email)
                            // OR base64 encoded email address
                            or any(strings.scan_base64(..scan.qr.url.url,
                                                       format="url",
                                                       ignore_padding=true
                                   ),
                                   strings.icontains(., ..email.email)
                            )
                          )
                  )
                  // a single path
                  and strings.count(.scan.qr.url.path, '/') == 2
                  and (
                    (
                      (
                        strings.contains(.scan.qr.url.path, '/$')
                        or strings.contains(.scan.qr.url.path, '/*')
                        or strings.contains(.scan.qr.url.path, '/#')
                      )
                      // subdomain should contain num{3}alpha or alphanum{3}
                      and regex.icontains(.scan.qr.url.domain.subdomain,
                                          '^(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)(?:$|\.)'
                      )
                      // url path should contain num{3}alpha or alphanum{3}
                      and regex.icontains(.scan.qr.url.path,
                                          '\/(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)\/'
                      )
                    )
                    or (
                      // special char in the path
                      (
                        strings.contains(.scan.qr.url.path, '!')
                        or strings.contains(.scan.qr.url.path, '@')
                      )
                      and (
                        strings.contains(.scan.qr.url.path, '/$')
                        or strings.contains(.scan.qr.url.path, '/*')
                        or strings.contains(.scan.qr.url.path, '/#')
                        // hex dollar sign
                        or strings.icontains(.scan.qr.url.path, '%24')
                        // hex star
                        or strings.icontains(.scan.qr.url.path, '%2A')
                        // hex pound
                        or strings.icontains(.scan.qr.url.path, '%23')
                      )
                      // ensure expected ordering
                      and regex.icontains(.scan.qr.url.url,
                                          '[!@].*(?:[$*]|%2[A43])'
                      )
                    )
                  )
          )
        )
        or (
          // pdf or images
          (
            .file_type == "pdf" or .file_type in $file_types_images
          )
          //
          // This rule makes use of a beta feature and is subject to change without notice
          // using the beta feature in custom rules is not suggested until it has been formally released
          //
          and any(beta.scan_qr(.).items,
                  .type is not null
                  // a single path
                  and strings.count(.url.path, '/') == 2
                  and (
                    (
                      (
                        strings.contains(.url.path, '/$')
                        or strings.contains(.url.path, '/*')
                        or strings.contains(.url.path, '/#')
                      )
                      // subdomain should contain num{3}alpha or alphanum{3}
                      and regex.icontains(.url.domain.subdomain,
                                          '^(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)(?:$|\.)'
                      )
                      // url path should contain num{3}alpha or alphanum{3}
                      and regex.icontains(.url.path,
                                          '\/(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)\/'
                      )
                    )
                    or (
                      // special char in the path
                      (
                        strings.contains(.url.path, '!')
                        or strings.contains(.url.path, '@')
                      )
                      and (
                        strings.contains(.url.path, '/$')
                        or strings.contains(.url.path, '/*')
                        or strings.contains(.url.path, '/#')
                        // hex dollar sign
                        or strings.icontains(.url.path, '%24')
                        // hex star
                        or strings.icontains(.url.path, '%2A')
                        // hex pound
                        or strings.icontains(.url.path, '%23')
                      )
                      // ensure expected ordering
                      and regex.icontains(.url.url, '[!@].*(?:[$*]|%2[A43])')
                    )
                  )
          )
        )
)

Detection logic

Scope: inbound message.

inbound message
length(recipients.to) is 1
recipients.to[0].email.domain.valid
any of attachments where any holds:
- all of:
  - .file_extension in $file_extensions_macros
  - any of file.explode(.) where all hold:
    
    .scan.qr.type is 'url'
    any of recipients.to where all hold:
    
    .email.domain.valid
    any of:
    
    strings.icontains(.scan.qr.url.url)
    any of strings.scan_base64(.scan.qr.url.url) where:
    
    strings.icontains(.)
    strings.count(.scan.qr.url.path, '/') is 2
    any of:
    
    all of:
    
    any of:
    
    .scan.qr.url.path contains '/$'
    .scan.qr.url.path contains '/*'
    .scan.qr.url.path contains '/#'
    .scan.qr.url.domain.subdomain matches '^(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)(?:$|\\.)'
    .scan.qr.url.path matches '\\/(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)\\/'
    all of:
    
    any of:
    
    .scan.qr.url.path contains '!'
    .scan.qr.url.path contains '@'
    .scan.qr.url.path contains any of 6 patterns
    
    /$
    /*
    /#
    %24
    %2A
    %23
    .scan.qr.url.url matches '[!@].*(?:[$*]|%2[A43])'
- all of:
  - any of:
    
    .file_type is 'pdf'
    .file_type in $file_types_images
  - any of beta.scan_qr(.).items where all hold:
    
    .type is set
    strings.count(.url.path, '/') is 2
    any of:
    
    all of:
    
    any of:
    
    .url.path contains '/$'
    .url.path contains '/*'
    .url.path contains '/#'
    .url.domain.subdomain matches '^(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)(?:$|\\.)'
    .url.path matches '\\/(?:[a-z]+[0-9]{3}|[0-9]{3}[a-z]+)\\/'
    all of:
    
    any of:
    
    .url.path contains '!'
    .url.path contains '@'
    .url.path contains any of 6 patterns
    
    /$
    /*
    /#
    %24
    %2A
    %23
    .url.url matches '[!@].*(?:[$*]|%2[A43])'

Inspects: attachments[].file_extension, attachments[].file_type, recipients.to, recipients.to[0].email.domain.valid, recipients.to[].email.domain.valid, recipients.to[].email.email, type.inbound. Sensors: beta.scan_qr, file.explode, regex.icontains, strings.contains, strings.count, strings.icontains, strings.scan_base64. Reference lists: $file_extensions_macros, $file_types_images.

Indicators matched (13)

Field	Match	Value
`file.explode(attachments[])[].scan.qr.type`	equals	`url`
`strings.contains`	substring	`/$`
`strings.contains`	substring	`/*`
`strings.contains`	substring	`/#`
`regex.icontains`	regex	`^(?:[a-z]+[0-9]{3}\|[0-9]{3}[a-z]+)(?:$\|\.)`
`regex.icontains`	regex	`\/(?:[a-z]+[0-9]{3}\|[0-9]{3}[a-z]+)\/`
`strings.contains`	substring	`!`
`strings.contains`	substring	`@`
`strings.icontains`	substring	`%24`
`strings.icontains`	substring	`%2A`
`strings.icontains`	substring	`%23`
`regex.icontains`	regex	`[!@].(?:[$]\|%2[A43])`

1 more

attachments[].file_type equals pdf

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)