From 35e80f7c543176eb55a83170dfac92e362beeade Mon Sep 17 00:00:00 2001 From: Brandon Murphy <4827852+zoomequipd@users.noreply.github.com> Date: Tue, 8 Sep 2026 08:18:13 -0500 Subject: [PATCH 1/2] Create attachment_pdf_link_dubsh.yml --- detection-rules/attachment_pdf_link_dubsh.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 detection-rules/attachment_pdf_link_dubsh.yml diff --git a/detection-rules/attachment_pdf_link_dubsh.yml b/detection-rules/attachment_pdf_link_dubsh.yml new file mode 100644 index 00000000000..96597c2e960 --- /dev/null +++ b/detection-rules/attachment_pdf_link_dubsh.yml @@ -0,0 +1,16 @@ +name: "Attachment: PDF with dub.sh shortened link" +description: "Catches messages carrying PDF attachments that embed links shortened through the dub.sh service. The lures vary widely, from fake 'password protected document' or e-signature notifications to business submission and proposal requests, but each relies on a PDF containing a shortened link to obscure the true destination and evade URL-based filtering." +type: "rule" +severity: "medium" +source: | + type.inbound and any(attachments, .file_type == "pdf" and any(file.explode(.), any(.scan.url.urls, .domain.root_domain == "dub.sh"))) +attack_types: + - "Credential Phishing" + - "BEC/Fraud" +tactics_and_techniques: + - "PDF" + - "Social engineering" + - "Evasion" +detection_methods: + - "File analysis" + - "URL analysis" From 48a4aaff6311d76a22f8d4c85fcfe9430b49922e Mon Sep 17 00:00:00 2001 From: CI Bot Date: Tue, 8 Sep 2026 13:20:24 +0000 Subject: [PATCH 2/2] Auto-format MQL and add rule IDs --- detection-rules/attachment_pdf_link_dubsh.yml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/detection-rules/attachment_pdf_link_dubsh.yml b/detection-rules/attachment_pdf_link_dubsh.yml index 96597c2e960..abf8b013e92 100644 --- a/detection-rules/attachment_pdf_link_dubsh.yml +++ b/detection-rules/attachment_pdf_link_dubsh.yml @@ -3,7 +3,13 @@ description: "Catches messages carrying PDF attachments that embed links shorten type: "rule" severity: "medium" source: | - type.inbound and any(attachments, .file_type == "pdf" and any(file.explode(.), any(.scan.url.urls, .domain.root_domain == "dub.sh"))) + type.inbound + and any(attachments, + .file_type == "pdf" + and any(file.explode(.), + any(.scan.url.urls, .domain.root_domain == "dub.sh") + ) + ) attack_types: - "Credential Phishing" - "BEC/Fraud" @@ -14,3 +20,4 @@ tactics_and_techniques: detection_methods: - "File analysis" - "URL analysis" +id: "36c01114-5437-5417-83ca-e8bdcd0c4488"