Sublime Security high experimental mql

Attachment: PDF with CVE-2026-34621 lures

Detects PDF attachments containing YARA signatures associated with CVE-2026-34621's observed lures.

View Source

Detection Logic

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            .depth == 0
            and any(.scan.yara.matches,
                    .name == "pdf_cve_2026_34621_observed_lures"
            )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...