Attachment: PDF with dub.sh shortened link

calendar Sep 9, 2026  ·
Share on: linkedin copy

Catches messages carrying PDF attachments that embed links shortened through the dub.sh service. The lures vary widely, from fake 'password protected document' or e-signature notifications to business submission and proposal requests, but each relies on a PDF containing a shortened link to obscure the true destination and evade URL-based filtering.

Sublime rule (View on GitHub)

 1name: "Attachment: PDF with dub.sh shortened link"
 2description: "Catches messages carrying PDF attachments that embed links shortened through the dub.sh service. The lures vary widely, from fake 'password protected document' or e-signature notifications to business submission and proposal requests, but each relies on a PDF containing a shortened link to obscure the true destination and evade URL-based filtering."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          .file_type == "pdf"
 9          and any(file.explode(.),
10                  any(.scan.url.urls, .domain.root_domain == "dub.sh")
11          )
12  )  
13attack_types:
14  - "Credential Phishing"
15  - "BEC/Fraud"
16tactics_and_techniques:
17  - "PDF"
18  - "Social engineering"
19  - "Evasion"
20detection_methods:
21  - "File analysis"
22  - "URL analysis"
23id: "36c01114-5437-5417-83ca-e8bdcd0c4488"
to-top