High Severity

Attachment: Risk assessment PDF with inline image

Labels

Malware/Ransomware

Spam

Description

Detects inbound messages containing a PDF attachment whose file name matches a 'risk assessment' naming pattern with an alphanumeric code, alongside an inline image attachment referenced via content ID in the HTML body. Messages from highly trusted sender domains that pass DMARC authentication are excluded.

References

No references.

Sublime Security

Created Aug 25th, 2026 • Last updated Aug 25th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(filter(attachments,
               .file_type in $file_types_images
               and .content_disposition == "inline"
        ),
        strings.icontains(body.html.raw, .content_id)
)
and any(attachments,
        .file_type == "pdf"
        and regex.icontains(.file_name, 'risk assessment [a-z]{2,4}[0-9]{6,}')
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.