• Sublime Core Feed
Medium Severity

Attachment: Suspicious Employee Policy Update Document Lure

Labels

Credential Phishing
PDF
Social engineering
Evasion
Content analysis
File analysis
Sender analysis

Description

Inbound message containing subject line and attachments related to handbook, compensation, or policy updates. Attachments are limited to Microsoft Word documents and match similar update-related terminology. This pattern has been observed used to delivery credential phishing via QR codes.

References

No references.

Sublime Security
Created Mar 31st, 2025 • Last updated Mar 31st, 2025
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and (
  // the subject contains pay related items
  (
    strings.icontains(subject.subject, 'salary')
    or regex.icontains(subject.subject, '\bpay(?:roll|\b)')
    or strings.icontains(subject.subject, 'bonus')
    or strings.icontains(subject.subject, 'incentive')
    or strings.icontains(subject.subject, 'merit')
    or strings.icontains(subject.subject, 'handbook')
    or strings.icontains(subject.subject, 'benefits')
  )
  and (
    strings.icontains(subject.subject, 'review')
    or strings.icontains(subject.subject, 'evaluation')
    or regex.icontains(subject.subject, 'eval\b')
    or strings.icontains(subject.subject, 'assessment')
    or strings.icontains(subject.subject, 'appraisal')
    or strings.icontains(subject.subject, 'feedback')
    or strings.icontains(subject.subject, 'performance')
    or strings.icontains(subject.subject, 'adjustment')
    or strings.icontains(subject.subject, 'increase')
    or strings.icontains(subject.subject, 'raise')
    or strings.icontains(subject.subject, 'change')
    or strings.icontains(subject.subject, 'modification')
    or strings.icontains(subject.subject, 'distribution')
    or regex.icontains(subject.subject, 'revis(?:ed|ion)')
    or regex.icontains(subject.subject, 'amend(?:ed|ment)')
    or regex.icontains(subject.subject, 'update(?:d| to)')
  )
)
and 0 < length(attachments) <= 3
and any(attachments,
        .file_extension in ("doc", "docx", "docm")
        and (
          strings.icontains(.file_name, 'salary')
          or regex.icontains(.file_name, '\bpay(?:roll|\b)')
          or strings.icontains(.file_name, 'bonus')
          or strings.icontains(.file_name, 'incentive')
          or strings.icontains(.file_name, 'merit')
          or strings.icontains(.file_name, 'handbook')
          or strings.icontains(.file_name, 'benefits')
        )
        and (
          strings.icontains(.file_name, 'review')
          or strings.icontains(.file_name, 'evaluation')
          or regex.icontains(.file_name, 'eval\b')
          or strings.icontains(.file_name, 'assessment')
          or strings.icontains(.file_name, 'appraisal')
          or strings.icontains(.file_name, 'feedback')
          or strings.icontains(.file_name, 'performance')
          or strings.icontains(.file_name, 'adjustment')
          or strings.icontains(.file_name, 'increase')
          or strings.icontains(.file_name, 'raise')
          or strings.icontains(.file_name, 'change')
          or strings.icontains(.file_name, 'modification')
          or strings.icontains(.file_name, 'distribution')
          or regex.icontains(.file_name, 'revis(?:ed|ion)')
          or regex.icontains(.file_name, 'amend(?:ed|ment)')
          or regex.icontains(.file_name, 'update(?:d| to)')
        )
)
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started