Medium Severity

Body: Bid solicitation PDF lure

Description

Detects inbound messages that greet the recipient with 'Dear Prospective Bidder,' and make use of a google hosted PDF icon as part of the lure.

References

No references.

Sublime Security
Created Oct 2nd, 2026 • Last updated Oct 2nd, 2026
Source
type.inbound
and strings.contains(body.current_thread.text, "Dear Prospective Bidder,")
and any(html.xpath(body.html,
                   '//table/tbody/tr/td/table//tr/td//table/tbody/tr/td'
        ).nodes,
        strings.ends_with(.display_text, ".pdf")
        and strings.contains(.raw,
                             "https://drive-thirdparty.googleusercontent.com/16/type/application/pdf"
        )
)
MQL Rule Console
•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Deploy and integrate a free Sublime instance in minutes.
Get Started