sublimemediumRule

Attachment: PDF with version-only producer and default metadata

Detects PDF attachments whose EXIF producer field contains only a version string (no software or product name) combined with default, anonymized metadata—untitled document, anonymous creator/author, and unspecified subject—and embedded OCR text prompting the recipient to open the document. This combination of an unnamed generation tool, placeholder metadata, and an open-document lure prompt is characteristic of automated PDF-generation kits used in credential phishing and BEC lures.

MITRE ATT&CK

T1566.002 T1534 T1656 T1566 T1566.001 T1598 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
and any(attachments,
        .file_type == "pdf"
        and any([beta.parse_exif(.)],
                regex.imatch(.producer, '[\d.\s()]*\d[\d.\s()]*')
                and 2 of (
                  .title =~ "untitled",
                  .creator =~ "anonymous",
                  .author =~ "anonymous",
                  any(.fields, .key == "Subject" and .value =~ "unspecified")
                )
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and regex.icontains(beta.ocr(.).text, 'open[\s\S]{0,20}document')
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: PDF with version-only producer and default metadata"
description: "Detects PDF attachments whose EXIF producer field contains only a version string (no software or product name) combined with default, anonymized metadata—untitled document, anonymous creator/author, and unspecified subject—and embedded OCR text prompting the recipient to open the document. This combination of an unnamed generation tool, placeholder metadata, and an open-document lure prompt is characteristic of automated PDF-generation kits used in credential phishing and BEC lures."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(attachments,
          .file_type == "pdf"
          and any([beta.parse_exif(.)],
                  regex.imatch(.producer, '[\d.\s()]*\d[\d.\s()]*')
                  and 2 of (
                    .title =~ "untitled",
                    .creator =~ "anonymous",
                    .author =~ "anonymous",
                    any(.fields, .key == "Subject" and .value =~ "unspecified")
                  )
          )
          //
          // This rule makes use of a beta feature and is subject to change without notice
          // using the beta feature in custom rules is not suggested until it has been formally released
          //
          and regex.icontains(beta.ocr(.).text, 'open[\s\S]{0,20}document')
  )
attack_types:
  - "BEC/Fraud"
  - "Credential Phishing"
tactics_and_techniques:
  - "Image as content"
  - "Social engineering"
  - "Evasion"
detection_methods:
  - "Exif analysis"
  - "Optical Character Recognition"
  - "Content analysis"
id: "40f73aea-39cf-5a36-a9bc-267bdf0f7cfc"