Attachment: PDF with Microsoft Purview message impersonation

calendar Nov 10, 2025  ·
Share on: linkedin copy

Detects PDF attachments containing text that impersonates Microsoft Purview secure message notifications, potentially used to trick users into believing they have received legitimate secure communications from Microsoft services.

Sublime rule (View on GitHub)

 1name: "Attachment: PDF with Microsoft Purview message impersonation"
 2description: "Detects PDF attachments containing text that impersonates Microsoft Purview secure message notifications, potentially used to trick users into believing they have received legitimate secure communications from Microsoft services."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(attachments, .file_extension == 'pdf'),
 8          any(ml.nlu_classifier(beta.ocr(.).text).topics,
 9              .name == 'Secure Message' and .confidence == 'high'
10          )
11          and strings.icontains(beta.ocr(.).text, "Microsoft Purview Message")
12  )
13  // negate highly trusted sender domains unless they fail DMARC authentication
14  and (
15    (
16      sender.email.domain.root_domain in $high_trust_sender_root_domains
17      and not headers.auth_summary.dmarc.pass
18    )
19    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
20  )  
21attack_types:
22  - "Credential Phishing"
23tactics_and_techniques:
24  - "Impersonation: Brand"
25  - "PDF"
26  - "Social engineering"
27detection_methods:
28  - "File analysis"
29  - "Natural Language Understanding"
30  - "Content analysis"
31id: "571d4964-dc44-56eb-bff4-11068b1cd119"
to-top