sublimehighRule

Attachment: PDF credential phishing via wkhtmltopdf/Qt with suspicious link

Detects inbound emails containing PDF attachments whose embedded metadata (creator/producer fields) indicates generation by wkhtmltopdf or Qt-based tools, both commonly used in malicious PDF creation. The rule extracts and OCRs the PDF content, then applies NLU classification to confirm credential theft intent. It further inspects URLs embedded in the PDF for suspicious patterns, such as very short paths or OAuth redirect parameters, which are often abused for credential phishing redirection.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598

initial-access

Detection Query

type.inbound
and any(filter(attachments,
               .file_type == "pdf"
               // creator and producer of PDF seen in malicious content
               and (
                 strings.starts_with(beta.parse_exif(.).creator, "wkhtmltopdf")
                 or strings.starts_with(beta.parse_exif(.).producer, "Qt ")
               )
        ),
        any(filter(file.explode(.), .scan.ocr.raw is not null),
            (
              any(ml.nlu_classifier(.scan.ocr.raw).intents,
                  .name in ('cred_theft', 'bec') and .confidence != 'low'
              )
            )
        )
        // suspicious link
        and any(file.explode(.),
                any(.scan.pdf.urls,
                    // short 1 char path
                    length(.path) == 2
                    // oauth redirect
                    or (
                      strings.istarts_with(.path, '/oauth/')
                      and strings.icontains(.query_params, 'redirect_uri=')
                    )
                )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: PDF credential phishing via wkhtmltopdf/Qt with suspicious link"
description: "Detects inbound emails containing PDF attachments whose embedded metadata (creator/producer fields) indicates generation by wkhtmltopdf or Qt-based tools, both commonly used in malicious PDF creation. The rule extracts and OCRs the PDF content, then applies NLU classification to confirm credential theft intent. It further inspects URLs embedded in the PDF for suspicious patterns, such as very short paths or OAuth redirect parameters, which are often abused for credential phishing redirection."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(filter(attachments,
                 .file_type == "pdf"
                 // creator and producer of PDF seen in malicious content
                 and (
                   strings.starts_with(beta.parse_exif(.).creator, "wkhtmltopdf")
                   or strings.starts_with(beta.parse_exif(.).producer, "Qt ")
                 )
          ),
          any(filter(file.explode(.), .scan.ocr.raw is not null),
              (
                any(ml.nlu_classifier(.scan.ocr.raw).intents,
                    .name in ('cred_theft', 'bec') and .confidence != 'low'
                )
              )
          )
          // suspicious link
          and any(file.explode(.),
                  any(.scan.pdf.urls,
                      // short 1 char path
                      length(.path) == 2
                      // oauth redirect
                      or (
                        strings.istarts_with(.path, '/oauth/')
                        and strings.icontains(.query_params, 'redirect_uri=')
                      )
                  )
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "PDF"
  - "Open redirect"
  - "Social engineering"
detection_methods:
  - "Exif analysis"
  - "Optical Character Recognition"
  - "Natural Language Understanding"
  - "URL analysis"
  - "File analysis"
id: "63977bda-8d15-543a-8308-6c2ba7884402"