Sublime Security medium experimental mql

Attachment: PDF with split QR code

Detects PDF attachments containing split QR codes positioned close together, a technique used to evade detection while maintaining QR code functionality for credential theft.

View Source

Detection Logic

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            any(.scan.yara.matches,
                // yara rules match on "split" QR codes that are 290x290, 300x300, 370x370 and placed close to eachtoher in the PDF
                strings.istarts_with(.name, 'Phishing_PDF_Split_QR_Code_Pair')
            )
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...