Sublime Security low experimental mql

Attachment: PDF with ReportLab library and default metadata

Detects PDF attachments generated using the ReportLab PDF Library with default anonymous metadata values, including untitled document, anonymous creator/author, and unspecified subject. This combination of characteristics is commonly associated with automated PDF generation tools used in malicious activities.

View Source

Detection Logic

type.inbound
and any(attachments,
        beta.parse_exif(.).producer == "ReportLab PDF Library - (opensource)"
        and beta.parse_exif(.).title == "untitled"
        and beta.parse_exif(.).creator == "anonymous"
        and any(beta.parse_exif(.).fields,
                .key == "Subject" and .value == "unspecified"
        )
        and beta.parse_exif(.).author == "anonymous"
)

Field Validations

Loading…

Comments (0)

Loading comments...