Medium Severity

Attachment: PDF with self-service platform links with self sender or blank recipients

Description

Detects single-page PDF attachments containing links to self-service content creation platforms, sent to either the sender's own email address or an invalid email domain. This pattern may indicate testing of malicious content or preparation for distribution.

References

No references.

Sublime Security
Created Jun 10th, 2026 • Last updated Jun 10th, 2026
Source
type.inbound
and sum([length(recipients.to), length(recipients.cc)]) == 1
and (
  sender.email.email == recipients.to[0].email.email
  or recipients.to[0].email.domain.valid == false
)
and length(attachments) == 1
and beta.parse_exif(attachments[0]).page_count == 1
and any(filter(attachments, .file_type == "pdf"),
        any(filter(file.explode(.), .depth == 0),
            1 <= length(filter(.scan.url.urls,
                               // remove mailto: links
                               not strings.istarts_with(.url, 'mailto:')
                               and not strings.istarts_with(.url, 'email:')
                               // remove links found in exiftool output producer/creator
                               and not any([
                                             ..scan.exiftool.producer,
                                             ..scan.exiftool.creator
                                           ],
                                           . is not null
                                           and strings.icontains(.,
                                                                 ..domain.domain
                                           )
                               )
                               and not .domain.root_domain in ('pdf-tools.com')
                               and not .url in (
                                 'https://gamma.app/?utm_source=made-with-gamma'
                               )
                        )
            ) <= 3
            and all(.scan.url.urls,
                    .domain.root_domain in $self_service_creation_platform_domains
                    or .domain.domain in $self_service_creation_platform_domains
            )
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started