Detection rules › Sublime MQL
Brand impersonation: Adobe Acrobat Sign PDF phishing file format template
Detects specific credential phishing PDF attachments that contain Adobe branding or Adobe Acrobat Sign text along with specific file format indicators, potentially indicating fraudulent documents impersonating legitimate Adobe services.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, PDF |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| type |
Rule body MQL
type.inbound
and any(filter(attachments, .file_type == "pdf"),
(
any(ml.logo_detect(.).brands, .name == "Adobe")
or strings.icontains(beta.ocr(.).text,
'Powered by Adobe Acrobat Sign'
)
or strings.icontains(beta.ocr(.).text, 'Adobe Acrobat Sign')
)
and strings.icontains(beta.ocr(.).text, 'File Format: PDF')
)
Detection logic
Scope: inbound message.
Detects specific credential phishing PDF attachments that contain Adobe branding or Adobe Acrobat Sign text along with specific file format indicators, potentially indicating fraudulent documents impersonating legitimate Adobe services.
- inbound message
any of
filter(attachments)where all hold:any of:
any of
ml.logo_detect(.).brandswhere:- .name is 'Adobe'
- beta.ocr(.).text contains 'Powered by Adobe Acrobat Sign'
- beta.ocr(.).text contains 'Adobe Acrobat Sign'
- beta.ocr(.).text contains 'File Format: PDF'
Inspects: attachments[].file_type, type.inbound. Sensors: beta.ocr, ml.logo_detect, strings.icontains.
Indicators matched (5)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
ml.logo_detect(filter(attachments)[]).brands[].name | equals | Adobe |
strings.icontains | substring | Powered by Adobe Acrobat Sign |
strings.icontains | substring | Adobe Acrobat Sign |
strings.icontains | substring | File Format: PDF |