Detection rules › Sublime MQL

Link: PDF file disguised as HTML page

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects inbound messages containing links that appear to reference PDF files but are actually HTML pages, indicated by URLs ending with '.pdf' followed by additional characters and '.html'. This technique is commonly used to bypass security filters and deceive recipients into believing they are accessing a legitimate PDF document.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing, Malware/Ransomware
Tactics and techniquesEvasion, PDF

Event coverage

Message attribute
body.current_thread
type

Rule body MQL

type.inbound
and any(body.current_thread.links,
        regex.icontains(.href_url.path, '\.pdf[^/]*\.html$')
) 

Detection logic

Scope: inbound message.

Detects inbound messages containing links that appear to reference PDF files but are actually HTML pages, indicated by URLs ending with '.pdf' followed by additional characters and '.html'. This technique is commonly used to bypass security filters and deceive recipients into believing they are accessing a legitimate PDF document.

  1. inbound message
  2. any of body.current_thread.links where:
    • .href_url.path matches '\\.pdf[^/]*\\.html$'

Inspects: body.current_thread.links, body.current_thread.links[].href_url.path, type.inbound. Sensors: regex.icontains.

Indicators matched (1)

FieldMatchValue
regex.icontainsregex\.pdf[^/]*\.html$