Attachment: PDF Link With Valueless Base64 Query Parameter

calendar Oct 6, 2026  ยท
Share on: linkedin copy

Detects PDF attachments containing embedded URLs whose query strings are base64-like tokens that decode to a single, empty-valued parameter.

Sublime rule (View on GitHub)

 1name: "Attachment: PDF Link With Valueless Base64 Query Parameter"
 2description: "Detects PDF attachments containing embedded URLs whose query strings are base64-like tokens that decode to a single, empty-valued parameter."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          (.file_type == "pdf" or .file_extension == "pdf")
 9          and any(file.explode(.),
10                  any(.scan.pdf.urls,
11                      .path == '/'
12                      and regex.imatch(.query_params, '[A-Fa-f0-9+/]{8}')
13                      and length(.query_params_decoded) == 1
14                      and all(flatten(values(.query_params_decoded)), . == '')
15                  )
16          )
17  )  
18attack_types:
19  - "Credential Phishing"
20tactics_and_techniques:
21  - "PDF"
22  - "Evasion"
23detection_methods:
24  - "File analysis"
25  - "URL analysis"
26id: "21ddda2f-d95e-54d2-a844-35c003df6bd5"
to-top