High Severity

Attachment: PDF With SAI Global ISO9001 Logo

Description

Detects PDF attachments containing embedded SAI Global ISO9001 logos, which may indicate brand impersonation or fraudulent certification claims.

References

No references.

Sublime Security
Created Apr 15th, 2026 • Last updated Apr 15th, 2026
Source
type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            any(.scan.yara.matches,
                // yara rule matches on an embedded SAI Global logo that allows for resized versions of the image
                .name == "SAI_Global_ISO9001_Logo_PDF_Fuzzy"
            )
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started