Sublime Security medium experimental mql

Attachment: Adobe Sign lure PDF with embedded banner images

Detects inbound messages containing PDF attachments that contain embedded banner images mimicking Adobe Sign branding, commonly used to deceive recipients into believing the document is legitimate.

View Source

Detection Logic

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            any(.scan.yara.matches, .name == 'adobe_sign_lure_banner_images')
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...