High Severity
Attachment: PDF with suspicious language and redirect to suspicious file type
Description
Attached PDF contains credential theft language, and links to an open redirect to a suspicious file type. This has been observed in-the-wild as a Qakbot technique.
Sublime Security
Created Aug 17th, 2023 • Last updated May 22nd, 2024
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments,
.file_type == "pdf"
and any(file.explode(.),
length(.scan.url.urls) > 0
and any(ml.nlu_classifier(.scan.ocr.raw).intents,
.name == "cred_theft" and .confidence in~ ("medium", "high")
)
and any(.scan.url.urls,
strings.icontains(ml.link_analysis(.).final_dom.display_text,
"Redirect Notice"
)
and (
strings.contains(ml.link_analysis(.).final_dom.display_text, ".zip")
or strings.contains(ml.link_analysis(.).final_dom.display_text, ".php")
)
)
)
)
Playground
Test against your own EMLs or sample data.