Attachment: Identity Confirmation With Document Unlock Code

calendar Jul 28, 2026  ·
Share on: linkedin copy

Detects short inbound messages referencing an attached document that requires the recipient to confirm their identity and enter a code to unlock it, sent within an active thread context.

Sublime rule (View on GitHub)

 1name: "Attachment: Identity Confirmation With Document Unlock Code"
 2description: "Detects short inbound messages referencing an attached document that requires the recipient to confirm their identity and enter a code to unlock it, sent within an active thread context."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // confirm to unlock language
 8  and strings.icontains(body.current_thread.text, "confirm your identity")
 9  and strings.icontains(body.current_thread.text, "code to unlock document")
10  // and attached document
11  and strings.icontains(body.current_thread.text, "attached document")
12  // short message length
13  and length(body.current_thread.text) < 500
14  // plus previous threads
15  and length(body.previous_threads) > 1  
16attack_types:
17  - "Credential Phishing"
18tactics_and_techniques:
19  - "Social engineering"
20  - "Encryption"
21  - "PDF"
22detection_methods:
23  - "Content analysis"
24id: "27c9cbd8-68b4-528a-98df-92147e4aedb5"
to-top