From c51a221231a4d33aac2688d5d74ed99856cec9c5 Mon Sep 17 00:00:00 2001
From: keaton-sublime <kyle.eaton@sublimesecurity.com>
Date: Wed, 15 Jul 2026 16:23:19 -0400
Subject: [PATCH 1/2] Create attachment_targeted_docx_ack_lure.yml

---
 .../attachment_targeted_docx_ack_lure.yml     | 40 +++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 detection-rules/attachment_targeted_docx_ack_lure.yml

diff --git a/detection-rules/attachment_targeted_docx_ack_lure.yml b/detection-rules/attachment_targeted_docx_ack_lure.yml
new file mode 100644
index 00000000000..0617634c777
--- /dev/null
+++ b/detection-rules/attachment_targeted_docx_ack_lure.yml
@@ -0,0 +1,40 @@
+name: "Attachment: Targeted DOCX with personalized recipient acknowledgement lure"
+description: "Detects inbound messages with a DOCX attachment containing a quarterly date reference, specific STATUS and ACKNOWLEDGEMENT formatting patterns, and a personalized salutation where the recipient's name or local email part is dynamically embedded in the document XML."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and any(filter(attachments, .file_type == "docx"),
+          any(filter(file.explode(.), .file_name == "word/document.xml"),
+              // doc xml has a QX 2026 type date
+              regex.contains(.scan.strings.raw, '<w:t>Q[1-4]\S202[5-9]<\/w:t>')
+              // and a couple of the terms we've seen in the document with specific spacing reqs
+              and strings.contains(.scan.strings.raw,
+                                   '<w:t xml:space="preserve">STATUS </w:t>'
+              )
+              and strings.contains(.scan.strings.raw,
+                                   '<w:t xml:space="preserve">ACKNOWLEDGEMENT </w:t>'
+              )
+              // and doc xml has some reference to the user's name in there too?
+              and any(regex.extract(.scan.strings.raw,
+                                    '<w:t xml:space="preserve">Dear </w:t></w:r><w:r><w:rPr><w:b /><w:bCs /><w:color w:val="[a-f0-9]{6}" /><w:sz w:val="[0-9]{1,3}" /><w:szCs w:val="[0-9]{1,3}" /></w:rPr><w:t>(?P<name>.*?)</w:t></w:r>'
+                      ),
+                      any(recipients.to,
+                          (
+                            ..named_groups["name"] =~ .email.local_part
+                            or ..named_groups["name"] =~ .display_name
+                          )
+                      )
+              )
+          )
+  )
+
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Social engineering"
+detection_methods:
+  - "Archive analysis"
+  - "Content analysis"
+  - "File analysis"
+  - "XML analysis"

From 714e536885d039a075f09a1ec519d0c5ad81e216 Mon Sep 17 00:00:00 2001
From: CI Bot <hello@sublimesecurity.com>
Date: Wed, 15 Jul 2026 20:26:27 +0000
Subject: [PATCH 2/2] Auto-format MQL and add rule IDs

---
 detection-rules/attachment_targeted_docx_ack_lure.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detection-rules/attachment_targeted_docx_ack_lure.yml b/detection-rules/attachment_targeted_docx_ack_lure.yml
index 0617634c777..f39c26b6011 100644
--- a/detection-rules/attachment_targeted_docx_ack_lure.yml
+++ b/detection-rules/attachment_targeted_docx_ack_lure.yml
@@ -38,3 +38,4 @@ detection_methods:
   - "Content analysis"
   - "File analysis"
   - "XML analysis"
+id: "095c280f-0a50-528f-84aa-35262a4ce768"