sublimehighRule

Attachment: Decoy PDF author (Julie P.)

This detection rule matches on messages containing one or more Decoy PDF attachments with metadata discovered to have been assoicated with malicious email campaigns featuring CrowdStrike, DocuSign, Human Resource and password expiration lures.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003

initial-access

Detection Query

type.inbound
and length(attachments) > 0
and any(attachments,
        .size <= 250000
        and .file_extension == "pdf"
        and any(file.explode(.),
                (
                  .scan.exiftool.producer == "DocFly"
                  or any(.scan.exiftool.fields,
                         .key == "XMPToolkit"
                         and strings.icontains(.value, 'DynaPDF')
                  )
                )
                and (
                  any(.scan.exiftool.fields,
                      .key == "CreatorTool"
                      and .value == "Acrobat PDFMaker 24 for Word"
                  )
                  or any(.scan.exiftool.fields,
                         .key == "ContentTypeId"
                         and .value == "2.2388136001807807e+43"
                  )
                  or any(.scan.exiftool.fields,
                         .key == "Creator"
                         and .value in ('Julie Peters', 'Julie Pieters')
                  )
                  or any(.scan.exiftool.fields,
                         .key == "Author"
                         and .value in ('Julie Peters', 'Julie Pieters')
                  )
                )
        )
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and not profile.by_sender().any_messages_benign

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: Decoy PDF author (Julie P.)"
description: "This detection rule matches on messages containing one or more Decoy PDF attachments with metadata discovered to have been assoicated with malicious email campaigns featuring CrowdStrike, DocuSign, Human Resource and password expiration lures."
type: "rule"
severity: "high"
source: |
  type.inbound
  and length(attachments) > 0
  and any(attachments,
          .size <= 250000
          and .file_extension == "pdf"
          and any(file.explode(.),
                  (
                    .scan.exiftool.producer == "DocFly"
                    or any(.scan.exiftool.fields,
                           .key == "XMPToolkit"
                           and strings.icontains(.value, 'DynaPDF')
                    )
                  )
                  and (
                    any(.scan.exiftool.fields,
                        .key == "CreatorTool"
                        and .value == "Acrobat PDFMaker 24 for Word"
                    )
                    or any(.scan.exiftool.fields,
                           .key == "ContentTypeId"
                           and .value == "2.2388136001807807e+43"
                    )
                    or any(.scan.exiftool.fields,
                           .key == "Creator"
                           and .value in ('Julie Peters', 'Julie Pieters')
                    )
                    or any(.scan.exiftool.fields,
                           .key == "Author"
                           and .value in ('Julie Peters', 'Julie Pieters')
                    )
                  )
          )
  )
  and (
    not profile.by_sender().solicited
    or (
      profile.by_sender().any_messages_malicious_or_spam
      and not profile.by_sender().any_messages_benign
    )
  )
  and not profile.by_sender().any_messages_benign
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "PDF"
detection_methods:
  - "File analysis"
  - "Content analysis"
  - "Sender analysis"
id: "4324213a-7f8e-5556-95e3-1ab4037d9b83"