• Sublime Core Feed
High Severity

Attachment: QR code with recipient targeting and special characters

Description

Detects messages with QR code in attachments containing special characters in the path that include the recipient's email address in either the URL path or fragment, potentially encoded in base64. The URLs have a simple path structure and may end with suspicious patterns.

References

No references.

Sublime Security
Created Jan 21st, 2026 • Last updated Jan 21st, 2026
Source
type.inbound
and length(recipients.to) == 1
and recipients.to[0].email.domain.valid
and any(attachments,
        any(file.explode(.),
            // special char in the path
            (
              strings.icontains(.scan.qr.url.path, '!')
              or strings.icontains(.scan.qr.url.path, '@')
            )
            // a single path
            and strings.count(.scan.qr.url.path, '/') == 2
            and (
              strings.icontains(.scan.qr.url.path, '/$')
              or strings.icontains(.scan.qr.url.path, '/*')
            )
            and (
              (
                strings.icontains(.scan.qr.url.path,
                                  recipients.to[0].email.email
                )
                or strings.icontains(.scan.qr.url.fragment,
                                     recipients.to[0].email.email
                )
                or any(strings.scan_base64(.scan.qr.url.path,
                                           ignore_padding=true
                       ),
                       strings.icontains(., recipients.to[0].email.email)
                )
                or any(strings.scan_base64(.scan.qr.url.fragment,
                                           ignore_padding=true
                       ),
                       strings.icontains(., recipients.to[0].email.email)
                )
              )
            )
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started