detection.wiki

Detection rules › Sublime MQL

Link: PDF display text with fake copyright claim template

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects messages containing fake copyright claims with table rows with 25px height images and links where the display text references PDF content, potentially indicating malicious PDF delivery attempts through deceptive formatting.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesEvasion, Image as content, PDF

Event coverage

Message attribute
body
type

Rule body MQL

type.inbound
and any(html.xpath(body.html, '//tr[td[1]/img[@height="25px"]]/td[2]//a]').nodes,
        strings.icontains(.display_text, "PDF")
)

Detection logic

Scope: inbound message.

Detects messages containing fake copyright claims with table rows with 25px height images and links where the display text references PDF content, potentially indicating malicious PDF delivery attempts through deceptive formatting.

  1. inbound message
  2. any of html.xpath(body.html, '//tr[td[1]/img[@height="25px"]]/td[2]//a]').nodes where:
    • .display_text contains 'PDF'

Inspects: body.html, type.inbound. Sensors: html.xpath, strings.icontains.

Indicators matched (1)

FieldMatchValue
strings.icontainssubstringPDF