sublimemediumRule

Body: Bid solicitation PDF lure

Detects inbound messages that greet the recipient with 'Dear Prospective Bidder,' and make use of a google hosted PDF icon as part of the lure.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1598

initial-access

Detection Query

type.inbound
and strings.contains(body.current_thread.text, "Dear Prospective Bidder,")
and any(html.xpath(body.html,
                   '//table/tbody/tr/td/table//tr/td//table/tbody/tr/td'
        ).nodes,
        strings.ends_with(.display_text, ".pdf")
        and strings.contains(.raw,
                             "https://drive-thirdparty.googleusercontent.com/16/type/application/pdf"
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Body: Bid solicitation PDF lure"
description: "Detects inbound messages that greet the recipient with 'Dear Prospective Bidder,' and make use of a google hosted PDF icon as part of the lure."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and strings.contains(body.current_thread.text, "Dear Prospective Bidder,")
  and any(html.xpath(body.html,
                     '//table/tbody/tr/td/table//tr/td//table/tbody/tr/td'
          ).nodes,
          strings.ends_with(.display_text, ".pdf")
          and strings.contains(.raw,
                               "https://drive-thirdparty.googleusercontent.com/16/type/application/pdf"
          )
  )
attack_types:
  - "BEC/Fraud"
tactics_and_techniques:
  - "Social engineering"
detection_methods:
  - "Content analysis"
  - "HTML analysis"
id: "7447b00f-e916-5911-a1af-ca73708ca713"