Sublime Security high experimental mql

Attachment: PDF with specific author metadata

Detects inbound messages containing PDF attachments where the EXIF metadata indicates the author or creator is 'Shelby Porter'.

View Source

Detection Logic

type.inbound
and length(filter(attachments, .file_type == "pdf")) >= 1
and any(filter(attachments, .file_type == "pdf"),
        beta.parse_exif(.).author == "Shelby Porter"
        or beta.parse_exif(.).creator == "Shelby Porter"
)

Field Validations

Loading…

Comments (0)

Loading comments...