Detection rules › Sublime MQL
Link: Multistage landing - Abused Adobe Acrobat hosted PDF
Detects an inbound message containing an Adobe Acrobat link that leads to a single page PDF document with suspicious indicators, including minimal text, brand logos, and document viewer language. The sender is not from Adobe.com and the message is not a reply.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing |
| Tactics and techniques | Impersonation: Brand, Social engineering |
Event coverage
| Message attribute |
|---|
| body |
| body.links (collection) |
| headers (collection) |
| sender.email |
| type |
Rule body MQL
type.inbound
and any(body.links,
.href_url.domain.domain == "acrobat.adobe.com"
and strings.istarts_with(.href_url.path, '/id/urn:')
)
and length(distinct(filter(body.links,
.href_url.domain.domain == "acrobat.adobe.com"
and strings.istarts_with(.href_url.path, '/id/urn:')
),
.href_url.url
)
) == 1
and any(filter(body.links,
.href_url.domain.domain == "acrobat.adobe.com"
and strings.istarts_with(.href_url.path, '/id/urn:')
),
any(ml.link_analysis(., mode="aggressive").additional_responses,
(
any(file.explode(.file),
any(.scan.exiftool.fields,
// password protected pdf
.key == "Warning"
and strings.icontains(.value, "password protected")
)
)
// a low amount of links
or (
any(file.explode(.file), 1 <= length(.scan.url.urls) <= 2)
// a single page
and any(file.explode(.file),
.scan.exiftool.page_count == 1
// occurs when there are exif errors
or .scan.exiftool.page_count is null
)
// susipicious indicators
and (
// logo detection of brands for file sharing companies
any(ml.logo_detect(.file).brands,
.name in ("DocuSign", "Adobe")
or strings.istarts_with(.name, 'Microsoft')
)
// look at the OCR of the document as well
or (
length(beta.ocr(.file).text) < 750
and (
strings.icontains(beta.ocr(.file).text, 'view document')
or strings.icontains(beta.ocr(.file).text,
'New PDF Document'
)
or strings.icontains(beta.ocr(.file).text,
'please wait...'
)
or strings.icontains(beta.ocr(.file).text,
"display this type of document"
)
or strings.icontains(beta.ocr(.file).text, 'PDF viewer')
or regex.icontains(beta.ocr(.file).text,
'e-sign(?:ature)?'
)
or strings.icontains(beta.ocr(.file).text,
'review and sign'
)
or strings.icontains(beta.ocr(.file).text,
'shared a document'
)
)
)
)
)
)
)
)
and length(headers.references) == 0
and headers.in_reply_to is null
and sender.email.domain.root_domain != "adobe.com"
Detection logic
Scope: inbound message.
Detects an inbound message containing an Adobe Acrobat link that leads to a single page PDF document with suspicious indicators, including minimal text, brand logos, and document viewer language. The sender is not from Adobe.com and the message is not a reply.
- inbound message
any of
body.linkswhere all hold:- .href_url.domain.domain is 'acrobat.adobe.com'
- .href_url.path starts with '/id/urn:'
- length(distinct(filter(body.links, .href_url.domain.domain == 'acrobat.adobe.com' and strings.istarts_with(.href_url.path, '/id/urn:')), .href_url.url)) is 1
any of
filter(body.links)where:any of
ml.link_analysis(., mode='aggressive').additional_responseswhere any holds:any of
file.explode(.file)where:any of
.scan.exiftool.fieldswhere all hold:- .key is 'Warning'
- .value contains 'password protected'
all of:
any of
file.explode(.file)where all hold:- length(.scan.url.urls) ≥ 1
- length(.scan.url.urls) ≤ 2
any of
file.explode(.file)where any holds:- .scan.exiftool.page_count is 1
- .scan.exiftool.page_count is missing
any of:
any of
ml.logo_detect(.file).brandswhere any holds:- .name in ('DocuSign', 'Adobe')
- .name starts with 'Microsoft'
all of:
- length(beta.ocr(.file).text) < 750
any of:
- beta.ocr(.file).text contains 'view document'
- beta.ocr(.file).text contains 'New PDF Document'
- beta.ocr(.file).text contains 'please wait...'
- beta.ocr(.file).text contains 'display this type of document'
- beta.ocr(.file).text contains 'PDF viewer'
- beta.ocr(.file).text matches 'e-sign(?:ature)?'
- beta.ocr(.file).text contains 'review and sign'
- beta.ocr(.file).text contains 'shared a document'
- length(headers.references) is 0
- headers.in_reply_to is missing
- sender.email.domain.root_domain is not 'adobe.com'
Inspects: body.links, body.links[].href_url.domain.domain, body.links[].href_url.path, headers.in_reply_to, headers.references, sender.email.domain.root_domain, type.inbound. Sensors: beta.ocr, file.explode, ml.link_analysis, ml.logo_detect, regex.icontains, strings.icontains, strings.istarts_with.
Indicators matched (15)
| Field | Match | Value |
|---|---|---|
body.links[].href_url.domain.domain | equals | acrobat.adobe.com |
strings.istarts_with | prefix | /id/urn: |
file.explode(ml.link_analysis(filter(body.links)[], mode='aggressive').additional_responses[].file)[].scan.exiftool.fields[].key | equals | Warning |
strings.icontains | substring | password protected |
ml.logo_detect(ml.link_analysis(filter(body.links)[], mode='aggressive').additional_responses[].file).brands[].name | member | DocuSign |
ml.logo_detect(ml.link_analysis(filter(body.links)[], mode='aggressive').additional_responses[].file).brands[].name | member | Adobe |
strings.istarts_with | prefix | Microsoft |
strings.icontains | substring | view document |
strings.icontains | substring | New PDF Document |
strings.icontains | substring | please wait... |
strings.icontains | substring | display this type of document |
strings.icontains | substring | PDF viewer |
3 more
regex.icontains | regex | e-sign(?:ature)? |
strings.icontains | substring | review and sign |
strings.icontains | substring | shared a document |