Sublime Security medium experimental mql

Attachment: PDF contains W9 or invoice YARA signatures

PDF attachment contains YARA signatures commonly associated with fraudulent W9 tax forms or invoice documents, which are frequently used in social engineering attacks to steal sensitive information or facilitate business email compromise.

View Source

Detection Logic

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            any(.scan.yara.matches,
                .name in ("w9_pdf_01", "invoice_pdf_01", "w9_pdf_IDs")
            )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...