Detection rules › Sublime MQL
Link: PDF file disguised as HTML page
Detects inbound messages containing links that appear to reference PDF files but are actually HTML pages, indicated by URLs ending with '.pdf' followed by additional characters and '.html'. This technique is commonly used to bypass security filters and deceive recipients into believing they are accessing a legitimate PDF document.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Credential Phishing, Malware/Ransomware |
| Tactics and techniques | Evasion, PDF |
Event coverage
| Message attribute |
|---|
| body.current_thread |
| type |
Rule body MQL
type.inbound
and any(body.current_thread.links,
regex.icontains(.href_url.path, '\.pdf[^/]*\.html$')
)
Detection logic
Scope: inbound message.
Detects inbound messages containing links that appear to reference PDF files but are actually HTML pages, indicated by URLs ending with '.pdf' followed by additional characters and '.html'. This technique is commonly used to bypass security filters and deceive recipients into believing they are accessing a legitimate PDF document.
- inbound message
any of
body.current_thread.linkswhere:- .href_url.path matches '\\.pdf[^/]*\\.html$'
Inspects: body.current_thread.links, body.current_thread.links[].href_url.path, type.inbound. Sensors: regex.icontains.
Indicators matched (1)
| Field | Match | Value |
|---|---|---|
regex.icontains | regex | \.pdf[^/]*\.html$ |