Detection rules › Sublime MQL

Sublime MQL rules: risk

Rule	Severity
Attachment: Risk assessment PDF with inline image	`high`

Attachment: Risk assessment PDF with inline image

Severity: high
Type: rule
Source: github.com/sublime-security/sublime-rules

Detects inbound messages containing a PDF attachment whose file name matches a 'risk assessment' naming pattern with an alphanumeric code, alongside an inline image attachment referenced via content ID in the HTML body. Messages from highly trusted sender domains that pass DMARC authentication are excluded.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

Category	Values
Attack types	Malware/Ransomware, Spam
Tactics and techniques	Image as content, PDF, Social engineering

Telemetry coverage

Platform	Record / event type
Sublime	Inbound email message

Message attributes

attachments
body
body.html
headers
headers.auth_summary
sender.email
type

Rule body

type.inbound
and any(filter(attachments,
               .file_type in $file_types_images
               and .content_disposition == "inline"
        ),
        strings.icontains(body.html.raw, .content_id)
)
and any(attachments,
        .file_type == "pdf"
        and regex.icontains(.file_name, 'risk assessment [a-z]{2,4}[0-9]{6,}')
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Detection logic

Scope: inbound message.

inbound message
any of filter(attachments) where:
- strings.icontains(body.html.raw)
any of attachments where all hold:
- .file_type is 'pdf'
- .file_name matches 'risk assessment [a-z]{2,4}[0-9]{6,}'
not:
- all of:
  - sender.email.domain.root_domain in $high_trust_sender_root_domains
  - coalesce(headers.auth_summary.dmarc.pass)

Inspects: attachments[].content_disposition, attachments[].file_name, attachments[].file_type, body.html.raw, headers.auth_summary.dmarc.pass, sender.email.domain.root_domain, type.inbound. Sensors: regex.icontains, strings.icontains. Reference lists: $file_types_images, $high_trust_sender_root_domains.

Indicators matched (3)

Field	Match	Value
`attachments[].content_disposition`	equals	`inline`
`attachments[].file_type`	equals	`pdf`
`regex.icontains`	regex	`risk assessment [a-z]{2,4}[0-9]{6,}`

Stages and Predicates

Stage 1: `mql_rule`

and
  any(attachments)
    and
      attachments.file_name regex_match "risk assessment [a-z]{2,4}[0-9]{6,}"
      attachments.file_type eq "pdf"
  not
    and
      coalesce func_call "coalesce(headers.auth_summary.dmarc.pass)"
       macro "sender.email.domain.root_domain in high_trust_sender_root_domains"
  any(filter(attachments))
    strings.icontains func_call "strings.icontains(body.html.raw)"
  type.inbound eq "true"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`type.inbound`	eq	`true` transforms: `boolean`	`field:"type.inbound" kind:eq value:"true"`