Sublime Security medium experimental mql

Attachment: PDF with Microsoft Purview message impersonation

Detects PDF attachments containing text that impersonates Microsoft Purview secure message notifications, potentially used to trick users into believing they have received legitimate secure communications from Microsoft services.

View Source

Detection Logic

type.inbound
and any(filter(attachments, .file_extension == 'pdf'),
        any(ml.nlu_classifier(beta.ocr(.).text).topics,
            .name == 'Secure Message' and .confidence == 'high'
        )
        and strings.icontains(beta.ocr(.).text, "Microsoft Purview Message")
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Field Validations

Loading…

Comments (0)

Loading comments...