Detection rules › Sublime MQL
Attachment: Fictitious invoice using LinkedIn's address
Detects PDF attachments created with wkhtmltopdf or Qt that contain LinkedIn's headquarters address (1000 W Maude Ave) in financial communications context, but do not mention LinkedIn itself.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | BEC/Fraud |
| Tactics and techniques | PDF, Social engineering |
Event coverage
| Message attribute |
|---|
| attachments (collection) |
| body.current_thread |
| type |
Rule body MQL
type.inbound
and 0 < length(filter(attachments, .file_type == "pdf")) < 3
and any(filter(attachments,
.file_type == "pdf"
// creator and producer of PDF seen in malicious content
and (
strings.starts_with(beta.parse_exif(.).creator, "wkhtmltopdf")
or strings.starts_with(beta.parse_exif(.).producer, "Qt ")
)
),
any(filter(file.explode(.), .scan.ocr.raw is not null),
// contains LinkedIn HQ address but not from LinkedIn
(
strings.icontains(.scan.ocr.raw, "1000 W Maude Ave")
and any(beta.ml_topic(body.current_thread.text).topics,
.name == "Financial Communications"
and .confidence != "low"
)
and not strings.icontains(.scan.ocr.raw, "linkedin")
),
)
)
Detection logic
Scope: inbound message.
Detects PDF attachments created with wkhtmltopdf or Qt that contain LinkedIn's headquarters address (1000 W Maude Ave) in financial communications context, but do not mention LinkedIn itself.
- inbound message
all of:
- length(filter(attachments, .file_type == 'pdf')) > 0
- length(filter(attachments, .file_type == 'pdf')) < 3
any of
filter(attachments)where:any of
filter(...)where all hold:- .scan.ocr.raw contains '1000 W Maude Ave'
any of
beta.ml_topic(body.current_thread.text).topicswhere all hold:- .name is 'Financial Communications'
- .confidence is not 'low'
not:
- .scan.ocr.raw contains 'linkedin'
Inspects: attachments[].file_type, body.current_thread.text, type.inbound. Sensors: beta.ml_topic, beta.parse_exif, file.explode, strings.icontains, strings.starts_with.
Indicators matched (6)
| Field | Match | Value |
|---|---|---|
attachments[].file_type | equals | pdf |
strings.starts_with | prefix | wkhtmltopdf |
strings.starts_with | prefix | Qt |
strings.icontains | substring | 1000 W Maude Ave |
beta.ml_topic(body.current_thread.text).topics[].name | equals | Financial Communications |
strings.icontains | substring | linkedin |