Detection rules › Sublime MQL

Brand impersonation: Adobe Acrobat Sign PDF phishing file format template

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects specific credential phishing PDF attachments that contain Adobe branding or Adobe Acrobat Sign text along with specific file format indicators, potentially indicating fraudulent documents impersonating legitimate Adobe services.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, PDF

Event coverage

Rule body MQL

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        (
          any(ml.logo_detect(.).brands, .name == "Adobe")
          or strings.icontains(beta.ocr(.).text,
                               'Powered by Adobe Acrobat Sign'
          )
          or strings.icontains(beta.ocr(.).text, 'Adobe Acrobat Sign')
        )
        and strings.icontains(beta.ocr(.).text, 'File Format: PDF')
)

Detection logic

Scope: inbound message.

Detects specific credential phishing PDF attachments that contain Adobe branding or Adobe Acrobat Sign text along with specific file format indicators, potentially indicating fraudulent documents impersonating legitimate Adobe services.

  1. inbound message
  2. any of filter(attachments) where all hold:
    • any of:
      • any of ml.logo_detect(.).brands where:
        • .name is 'Adobe'
      • beta.ocr(.).text contains 'Powered by Adobe Acrobat Sign'
      • beta.ocr(.).text contains 'Adobe Acrobat Sign'
    • beta.ocr(.).text contains 'File Format: PDF'

Inspects: attachments[].file_type, type.inbound. Sensors: beta.ocr, ml.logo_detect, strings.icontains.

Indicators matched (5)

FieldMatchValue
attachments[].file_typeequalspdf
ml.logo_detect(filter(attachments)[]).brands[].nameequalsAdobe
strings.icontainssubstringPowered by Adobe Acrobat Sign
strings.icontainssubstringAdobe Acrobat Sign
strings.icontainssubstringFile Format: PDF