sublimehighRule

Attachment: Decoy PDF author (Julie P.)

This detection rule matches on messages containing one or more Decoy PDF attachments with metadata discovered to have been assoicated with malicious email campaigns featuring CrowdStrike, DocuSign, Human Resource and password expiration lures.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003

initial-access

Detection Query

type.inbound
and length(attachments) > 0
and any(attachments,
        .size <= 250000
        and .file_extension == "pdf"
        and any(file.explode(.),
                (
                  .scan.exiftool.producer == "DocFly"
                  or any(.scan.exiftool.fields,
                         .key == "XMPToolkit"
                         and strings.icontains(.value, 'DynaPDF')
                  )
                )
                and (
                  any(.scan.exiftool.fields,
                      .key == "CreatorTool"
                      and .value == "Acrobat PDFMaker 24 for Word"
                  )
                  or any(.scan.exiftool.fields,
                         .key == "ContentTypeId"
                         and .value == "2.2388136001807807e+43"
                  )
                  or any(.scan.exiftool.fields,
                         .key == "Creator"
                         and .value in ('Julie Peters', 'Julie Pieters')
                  )
                  or any(.scan.exiftool.fields,
                         .key == "Author"
                         and .value in ('Julie Peters', 'Julie Pieters')
                  )
                )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: Decoy PDF author (Julie P.)"
description: "This detection rule matches on messages containing one or more Decoy PDF attachments with metadata discovered to have been assoicated with malicious email campaigns featuring CrowdStrike, DocuSign, Human Resource and password expiration lures."
type: "rule"
severity: "high"
source: |
  type.inbound
  and length(attachments) > 0
  and any(attachments,
          .size <= 250000
          and .file_extension == "pdf"
          and any(file.explode(.),
                  (
                    .scan.exiftool.producer == "DocFly"
                    or any(.scan.exiftool.fields,
                           .key == "XMPToolkit"
                           and strings.icontains(.value, 'DynaPDF')
                    )
                  )
                  and (
                    any(.scan.exiftool.fields,
                        .key == "CreatorTool"
                        and .value == "Acrobat PDFMaker 24 for Word"
                    )
                    or any(.scan.exiftool.fields,
                           .key == "ContentTypeId"
                           and .value == "2.2388136001807807e+43"
                    )
                    or any(.scan.exiftool.fields,
                           .key == "Creator"
                           and .value in ('Julie Peters', 'Julie Pieters')
                    )
                    or any(.scan.exiftool.fields,
                           .key == "Author"
                           and .value in ('Julie Peters', 'Julie Pieters')
                    )
                  )
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "PDF"
detection_methods:
  - "File analysis"
  - "Content analysis"
id: "4324213a-7f8e-5556-95e3-1ab4037d9b83"