Detection rules › Sublime MQL
Link: Self-sent PDF lure with subject correlation
Detects messages sent from a user to themselves containing bold PDF links where the link text correlates with the subject line or sender domain, potentially indicating a compromised account or social engineering technique.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud, Credential Phishing |
| Tactics and techniques | Social engineering, Evasion |
Event coverage
| Message attribute |
|---|
| body |
| recipients |
| recipients.to (collection) |
| sender.email |
| subject |
| type |
Rule body MQL
type.inbound
// self sender
and (
length(recipients.to) == 1
and recipients.to[0].email.email == sender.email.email
)
// bold a tags ending in PDF
and any(html.xpath(body.html, '//a[./b]').nodes,
strings.iends_with(.display_text, ".pdf")
and (
// subject appears as the .pdf link
any(regex.extract(subject.base, '(?P<word>\w+)'),
strings.contains(..display_text, .named_groups["word"])
)
// OR sender domain appears as the pdf link
or strings.icontains(.display_text, sender.email.domain.sld)
)
// we should NOT match urls
and strings.parse_url(.display_text, strict=false).url is null
and not any(.links, strings.iends_with(.href_url.path, '.pdf'))
)
Detection logic
Scope: inbound message.
Detects messages sent from a user to themselves containing bold PDF links where the link text correlates with the subject line or sender domain, potentially indicating a compromised account or social engineering technique.
- inbound message
all of:
- length(recipients.to) is 1
- recipients.to[0].email.email is sender.email.email
any of
html.xpath(body.html, '//a[./b]').nodeswhere all hold:- .display_text ends with '.pdf'
any of:
any of
regex.extract(subject.base)where:- strings.contains(.display_text)
- strings.icontains(.display_text)
- strings.parse_url(.display_text, strict=False).url is missing
not:
any of
.linkswhere:- .href_url.path ends with '.pdf'
Inspects: body.html, recipients.to, recipients.to[0].email.email, sender.email.domain.sld, sender.email.email, subject.base, type.inbound. Sensors: html.xpath, regex.extract, strings.contains, strings.icontains, strings.iends_with, strings.parse_url.
Indicators matched (2)
| Field | Match | Value |
|---|---|---|
strings.iends_with | suffix | .pdf |
regex.extract | regex | (?P<word>\w+) |