High Severity
Compensation Review With QR Code in Attached EML
Description
Detects inbound messages containing compensation-related terms (salary, bonus, merit, etc.) combined with review/change language that include EML attachments containing QR codes or barcodes in scanned documents.
References
No references.
Sublime Security
Created Apr 3rd, 2025 • Last updated Apr 3rd, 2025
Feed Source
Sublime Core Feed
Source
type.inbound
// the subject contains pay related items
and (
strings.icontains(subject.subject, 'salary')
or strings.icontains(subject.subject, 'compensation')
or regex.icontains(subject.subject, 'comp\b')
or regex.icontains(subject.subject, '\bpay(?:roll|\b)')
or strings.icontains(subject.subject, 'bonus')
or strings.icontains(subject.subject, 'incentive')
or strings.icontains(subject.subject, 'merit')
or strings.icontains(subject.subject, 'handbook')
or strings.icontains(subject.subject, 'benefits')
)
// subjects include review/updates/changes
and (
strings.icontains(subject.subject, 'review')
or strings.icontains(subject.subject, 'evaluation')
or regex.icontains(subject.subject, 'eval\b')
or strings.icontains(subject.subject, 'assessment')
or strings.icontains(subject.subject, 'appraisal')
or strings.icontains(subject.subject, 'feedback')
or strings.icontains(subject.subject, 'performance')
or strings.icontains(subject.subject, 'adjustment')
or strings.icontains(subject.subject, 'increase')
or strings.icontains(subject.subject, 'raise')
or strings.icontains(subject.subject, 'change')
or strings.icontains(subject.subject, 'modification')
or strings.icontains(subject.subject, 'distribution')
or regex.icontains(subject.subject, 'revis(?:ed|ion)')
or regex.icontains(subject.subject, 'amend(?:ed|ment)')
or regex.icontains(subject.subject, 'update(?:d| to)')
)
and any(filter(attachments, .content_type == "message/rfc822"),
any(file.parse_eml(.).attachments,
any(file.explode(.),
(
regex.icontains(.scan.ocr.raw, 'scan|camera')
and regex.icontains(.scan.ocr.raw, '\bQR\b|Q\.R\.|barcode')
)
or .scan.qr.type == "url" and .scan.qr.url.domain.valid
)
)
)
Playground
Test against your own EMLs or sample data.