Detection rules › Sublime MQL
Attachment: USDA bid invitation impersonation
Detects messages claiming to be from USDA containing bid invitations with macro-enabled attachments or PDFs. Validates USDA-related content through OCR and natural language analysis.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | Impersonation: Brand, PDF, Macros, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| body.current_thread |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
and length(attachments) == 1
and all(attachments,
(.file_extension in~ $file_extensions_macros or .file_type == "pdf")
and any(file.explode(.),
any(ml.nlu_classifier(.scan.ocr.raw).entities,
strings.icontains(.text, "Agriculture")
)
)
)
and strings.icontains(body.current_thread.text, "bid")
and (
strings.icontains(subject.subject, 'invitation to bid')
or any(attachments, strings.icontains(.file_name, 'usda'))
)
and strings.icontains(sender.email.domain.domain, "usda")
and any(ml.nlu_classifier(body.current_thread.text).entities,
.text == "usda" and .name in ("sender", "org")
)
Detection logic
Scope: inbound message.
Detects messages claiming to be from USDA containing bid invitations with macro-enabled attachments or PDFs. Validates USDA-related content through OCR and natural language analysis.
- inbound message
- length(attachments) is 1
all of
attachmentswhere all hold:any of:
- .file_extension in $file_extensions_macros
- .file_type is 'pdf'
any of
file.explode(.)where:any of
ml.nlu_classifier(.scan.ocr.raw).entitieswhere:- .text contains 'Agriculture'
- body.current_thread.text contains 'bid'
any of:
- subject.subject contains 'invitation to bid'
any of
attachmentswhere:- .file_name contains 'usda'
- sender.email.domain.domain contains 'usda'
any of
ml.nlu_classifier(body.current_thread.text).entitieswhere all hold:- .text is 'usda'
- .name in ('sender', 'org')
Inspects: attachments[].file_extension, attachments[].file_name, attachments[].file_type, body.current_thread.text, sender.email.domain.domain, subject.subject, type.inbound. Sensors: file.explode, ml.nlu_classifier, strings.icontains. Reference lists: $file_extensions_macros.
Indicators matched (8)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
strings.icontains | substring | Agriculture |
strings.icontains | substring | bid |
strings.icontains | substring | invitation to bid |
strings.icontains | substring | usda |
ml.nlu_classifier(body.current_thread.text).entities[].text | equals | usda |
ml.nlu_classifier(body.current_thread.text).entities[].name | member | sender |
ml.nlu_classifier(body.current_thread.text).entities[].name | member | org |