Sublime Security high experimental mql

Attachment: PDF file with embedded content

Threat actors may embed files within PDF documents, including macro-enabled documents, in an attempt to bypass security controls and social engineer a recipient into running malicious code.

View Source

Detection Logic

type.inbound
and (
  (
    sender.email.domain.root_domain in $free_email_providers
    and sender.email.email not in $recipient_emails
  )
  or (
    sender.email.domain.root_domain not in $free_email_providers
    and sender.email.domain.domain not in $recipient_domains
  )
)
and any(attachments,
        (
          .file_extension == "pdf"
          and any(file.explode(.),
                  any(.flavors.yara,
                      . in (
                        "iso_file",
                        "vb_file",
                        "base64_pe",
                        "encrypted_word_document",
                        "olecf_file",
                        "ooxml_file",
                        "encrypted_zip",
                        "mhtml_file",
                        "rar_file",
                        "tar_file",
                        "xar_file",
                        "bzip2_file",
                        "gzip_file",
                        "lzma_file",
                        "xz_file",
                        "zlib_file",
                        "elf_file",
                        "batch_file",
                        "hta_file"
                      )
                  )
          )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...