Sublime Security medium experimental mql

Attachment: PDF with secure document acknowledgment prompt

Detects PDF attachments matching yara rules looking for fake secure document prompts, including acknowledgment-style lures and suspicious image sizing.

View Source

Detection Logic

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            any(.scan.yara.matches,
                .name in (
                  "pdf_prompt_ack_secure_document_link",
                  "pdf_prompt_ack_secure_document_image_sizes"
                )
            )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...