Add detection rule for suspicious PDF links in RFQ/RFP

[peterdj45]

Description

This rule detects messages with reply or forward subjects that contain links appearing as PDF files but redirect to potentially malicious domains, specifically targeting RFQ or RFP terminology.

Associated samples

• https://platform.sublime.security/messages/504cfe0687a1b6a3d3d0fe73a21cca84d92e6029d5c930db4adac8e7743da502
• https://platform.sublime.security/messages/5078481f96e7cc2ed5737bee7d54954bb9aaba037c61c83fc9bbcf0fb0658a95?preview_id=019e6bcb-f4cb-752b-b6c3-22d2ca800559

Associated hunts

• https://platform.sublime.security/messages/hunt?huntId=019e70c2-1cde-73c5-953e-7ff467767c32

[peterdj45]

multi-hunts look good, results in ESC-14369

[IndiaAce]

Reviewing the telemetry in shared samples I'm not sure if we're getting enough unique coverage from https://github.com/sublime-security/sublime-rules/blob/883ff2f87408afb3c14f06f075915d974d009e7e/detection-rules/suspicious_request_for_quote_or_purchase.yml to warrant making a net-new rule for this. What are your thoughts on folding in the PDF angle to the change I made to this rule a few months ago: https://github.com/sublime-security/sublime-rules/pull/4401/changes up to conversation about that.

adding something like

  or (
    any(body.current_thread.links,
        strings.iends_with(.display_text, '.pdf')
        and regex.icontains(.display_text,
                            '(\bR\.?F\.?P\b|\bR\.?F\.?Q\b|Request.for.(?:Quot(e|ation)|Purchas(e|ing))|proposal|purchase.?order)'
        )
    )
  )

[IndiaAce]

I'm going to remove review-needed for the time being on this but feel free to PM me or just remark it ready for review whenever you're ready thanks!