Attachment: Targeted DOCX with personalized recipient acknowledgement lure

calendar Aug 4, 2026  ·
Share on: linkedin copy

Detects inbound messages with a DOCX attachment containing a quarterly date reference, specific STATUS and ACKNOWLEDGEMENT formatting patterns, and a personalized salutation where the recipient's name or local email part is dynamically embedded in the document XML.

Sublime rule (View on GitHub)

 1name: "Attachment: Targeted DOCX with personalized recipient acknowledgement lure"
 2description: "Detects inbound messages with a DOCX attachment containing a quarterly date reference, specific STATUS and ACKNOWLEDGEMENT formatting patterns, and a personalized salutation where the recipient's name or local email part is dynamically embedded in the document XML."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(attachments, .file_type == "docx"),
 8          any(filter(file.explode(.), .file_name == "word/document.xml"),
 9              // doc xml has a QX 2026 type date
10              regex.contains(.scan.strings.raw, '<w:t>Q[1-4]\S202[5-9]<\/w:t>')
11              // and a couple of the terms we've seen in the document with specific spacing reqs
12              and strings.contains(.scan.strings.raw,
13                                   '<w:t xml:space="preserve">STATUS </w:t>'
14              )
15              and strings.contains(.scan.strings.raw,
16                                   '<w:t xml:space="preserve">ACKNOWLEDGEMENT </w:t>'
17              )
18              // and doc xml has some reference to the user's name in there too?
19              and any(regex.extract(.scan.strings.raw,
20                                    '<w:t xml:space="preserve">Dear </w:t></w:r><w:r><w:rPr><w:b /><w:bCs /><w:color w:val="[a-f0-9]{6}" /><w:sz w:val="[0-9]{1,3}" /><w:szCs w:val="[0-9]{1,3}" /></w:rPr><w:t>(?P<name>.*?)</w:t></w:r>'
21                      ),
22                      any(recipients.to,
23                          (
24                            ..named_groups["name"] =~ .email.local_part
25                            or ..named_groups["name"] =~ .display_name
26                          )
27                      )
28              )
29          )
30  )  
31
32attack_types:
33  - "Credential Phishing"
34tactics_and_techniques:
35  - "Social engineering"
36detection_methods:
37  - "Archive analysis"
38  - "Content analysis"
39  - "File analysis"
40  - "XML analysis"
41id: "095c280f-0a50-528f-84aa-35262a4ce768"
to-top