Attachment: PDF credential phishing via wkhtmltopdf/Qt with suspicious link

name: "Attachment: PDF credential phishing via wkhtmltopdf/Qt with suspicious link"
description: "Detects inbound emails containing PDF attachments whose embedded metadata (creator/producer fields) indicates generation by wkhtmltopdf or Qt-based tools, both commonly used in malicious PDF creation. The rule extracts and OCRs the PDF content, then applies NLU classification to confirm credential theft intent. It further inspects URLs embedded in the PDF for suspicious patterns, such as very short paths or OAuth redirect parameters, which are often abused for credential phishing redirection."
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(filter(attachments,
                 .file_type == "pdf"
                 // creator and producer of PDF seen in malicious content
                 and (
                   strings.starts_with(beta.parse_exif(.).creator, "wkhtmltopdf")
                   or strings.starts_with(beta.parse_exif(.).producer, "Qt ")
                 )
          ),
          (
            any(filter(file.explode(.), .scan.ocr.raw is not null),
                (
                  any(ml.nlu_classifier(.scan.ocr.raw).intents,
                      .name in ('cred_theft', 'bec') and .confidence != 'low'
                  )
                )
            )
            or any(ml.logo_detect(.).brands, .name == 'Microsoft')
          )
          // suspicious link
          and (
            any(file.explode(.),
                any(.scan.pdf.urls,
                    // short 1 char path
                    length(.path) == 2
                    // oauth redirect
                    or (
                      strings.istarts_with(.path, '/oauth/')
                      and strings.icontains(.query_params, 'redirect_uri=')
                    )
                    // short 1 char path in redirect
                    or any(.query_params_decoded['redirect'],
                           length(strings.parse_url(.).path) == 2
                    )
                    // url param conatins recipeint domain
                    or any(.query_params_decoded['url'],
                           strings.contains(strings.parse_url(.).path,
                                            recipients.to[0].email.domain.sld
                           )
                    )
                    // multiple redirectUrl query_parms
                    or length(.query_params_decoded['redirectUrl']) > 1
                )
            )
            // sendgrid link, only on single-page PDFs
            or (
              beta.parse_exif(.).page_count == 1
              and any(file.explode(.),
                      any(.scan.pdf.urls,
                          strings.iends_with(.domain.domain, 'ct.sendgrid.net')
                          and .path == '/ls/click'
                      )
              )
            )
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "PDF"
  - "Open redirect"
  - "Social engineering"
detection_methods:
  - "Exif analysis"
  - "Optical Character Recognition"
  - "Natural Language Understanding"
  - "URL analysis"
  - "File analysis"
id: "63977bda-8d15-543a-8308-6c2ba7884402"