Body: Bid solicitation PDF lure

calendar Oct 2, 2026  ยท
Share on: linkedin copy

Detects inbound messages that greet the recipient with 'Dear Prospective Bidder,' and make use of a google hosted PDF icon as part of the lure.

Sublime rule (View on GitHub)

 1name: "Body: Bid solicitation PDF lure"
 2description: "Detects inbound messages that greet the recipient with 'Dear Prospective Bidder,' and make use of a google hosted PDF icon as part of the lure."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and strings.contains(body.current_thread.text, "Dear Prospective Bidder,")
 8  and any(html.xpath(body.html,
 9                     '//table/tbody/tr/td/table//tr/td//table/tbody/tr/td'
10          ).nodes,
11          strings.ends_with(.display_text, ".pdf")
12          and strings.contains(.raw,
13                               "https://drive-thirdparty.googleusercontent.com/16/type/application/pdf"
14          )
15  )  
16attack_types:
17  - "BEC/Fraud"
18tactics_and_techniques:
19  - "Social engineering"
20detection_methods:
21  - "Content analysis"
22  - "HTML analysis"
23id: "7447b00f-e916-5911-a1af-ca73708ca713"
to-top