Sublime Security medium experimental mql

Link: PDF display text with fake copyright claim template

Detects messages containing fake copyright claims with table rows with 25px height images and links where the display text references PDF content, potentially indicating malicious PDF delivery attempts through deceptive formatting.

View Source

Detection Logic

type.inbound
and any(html.xpath(body.html, '//tr[td[1]/img[@height="25px"]]/td[2]//a]').nodes,
        strings.icontains(.display_text, "PDF")
)

Field Validations

Loading…

Comments (0)

Loading comments...