• Sublime Core Feed
High Severity

Compensation Review With QR Code in Attached EML

Labels

Credential Phishing
QR code
Social engineering
Computer Vision
Content analysis
Optical Character Recognition
QR code analysis

Description

Detects inbound messages containing compensation-related terms (salary, bonus, merit, etc.) combined with review/change language that include EML attachments containing QR codes or barcodes in scanned documents.

References

No references.

Sublime Security
Created Apr 3rd, 2025 • Last updated Apr 3rd, 2025
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound

// the subject contains pay related items
and (
  strings.icontains(subject.subject, 'salary')
  or strings.icontains(subject.subject, 'compensation')
  or regex.icontains(subject.subject, 'comp\b')
  or regex.icontains(subject.subject, '\bpay(?:roll|\b)')
  or strings.icontains(subject.subject, 'bonus')
  or strings.icontains(subject.subject, 'incentive')
  or strings.icontains(subject.subject, 'merit')
  or strings.icontains(subject.subject, 'handbook')
  or strings.icontains(subject.subject, 'benefits')
)
// subjects include review/updates/changes
and (
  strings.icontains(subject.subject, 'review')
  or strings.icontains(subject.subject, 'evaluation')
  or regex.icontains(subject.subject, 'eval\b')
  or strings.icontains(subject.subject, 'assessment')
  or strings.icontains(subject.subject, 'appraisal')
  or strings.icontains(subject.subject, 'feedback')
  or strings.icontains(subject.subject, 'performance')
  or strings.icontains(subject.subject, 'adjustment')
  or strings.icontains(subject.subject, 'increase')
  or strings.icontains(subject.subject, 'raise')
  or strings.icontains(subject.subject, 'change')
  or strings.icontains(subject.subject, 'modification')
  or strings.icontains(subject.subject, 'distribution')
  or regex.icontains(subject.subject, 'revis(?:ed|ion)')
  or regex.icontains(subject.subject, 'amend(?:ed|ment)')
  or regex.icontains(subject.subject, 'update(?:d| to)')
)
and any(filter(attachments, .content_type == "message/rfc822"),
        any(file.parse_eml(.).attachments,
            any(file.explode(.),
                (
                  regex.icontains(.scan.ocr.raw, 'scan|camera')
                  and regex.icontains(.scan.ocr.raw, '\bQR\b|Q\.R\.|barcode')
                )
                or .scan.qr.type == "url" and .scan.qr.url.domain.valid
            )
        )
)
MQL Rule Console
DocsLearning Labs

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started