Attachment: PDF with Microsoft Purview message impersonation

calendar Sep 23, 2026  ·
Share on: linkedin copy

Detects PDF attachments containing text that impersonates Microsoft Purview secure message notifications, potentially used to trick users into believing they have received legitimate secure communications from Microsoft services.

Sublime rule (View on GitHub)

 1name: "Attachment: PDF with Microsoft Purview message impersonation"
 2description: "Detects PDF attachments containing text that impersonates Microsoft Purview secure message notifications, potentially used to trick users into believing they have received legitimate secure communications from Microsoft services."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(attachments, .file_extension == 'pdf'),
 8          any(ml.nlu_classifier(beta.ocr(.).text).topics,
 9              .name == 'Secure Message' and .confidence == 'high'
10          )
11          and strings.icontains(beta.ocr(.).text, "Microsoft Purview Message")
12  )
13  // negate highly trusted sender domains unless they fail DMARC authentication
14  and not (
15    sender.email.domain.root_domain in $high_trust_sender_root_domains
16    and coalesce(headers.auth_summary.dmarc.pass, false)
17  )  
18attack_types:
19  - "Credential Phishing"
20tactics_and_techniques:
21  - "Impersonation: Brand"
22  - "PDF"
23  - "Social engineering"
24detection_methods:
25  - "File analysis"
26  - "Natural Language Understanding"
27  - "Content analysis"
28id: "571d4964-dc44-56eb-bff4-11068b1cd119"
to-top