Sublime Security medium experimental mql

Attachment: PDF with suspicious document view lure

Detects PDF attachments containing a title box designed to lure recipients into viewing a document, a common social engineering technique used to direct users to malicious content.

View Source

Detection Logic

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            any(.scan.yara.matches, .name == "pdf_view_doc_here_title_box")
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...