sublimemediumRule

Attachment: Single-page PDF with S3-hosted HTML link

Detects inbound messages containing a single-page PDF attachment that includes exactly one URL, which links directly to an HTML file hosted on an Amazon S3 bucket. This technique is commonly used to redirect recipients to credential harvesting pages while leveraging trusted cloud infrastructure to evade detection.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(attachments,
        .file_type == "pdf"
        // a single page pdf
        and beta.parse_exif(.).page_count == 1
        and any(file.explode(.),
                length(.scan.pdf.urls) == 1
                and any(.scan.pdf.urls,
                        strings.contains(.path, '.html')
                        and // links directly to a S3 bucket
                        .domain.root_domain == "amazonaws.com"
                        and strings.icontains(.domain.subdomain, "s3")
                )
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: Single-page PDF with S3-hosted HTML link"
description: "Detects inbound messages containing a single-page PDF attachment that includes exactly one URL, which links directly to an HTML file hosted on an Amazon S3 bucket. This technique is commonly used to redirect recipients to credential harvesting pages while leveraging trusted cloud infrastructure to evade detection."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(attachments,
          .file_type == "pdf"
          // a single page pdf
          and beta.parse_exif(.).page_count == 1
          and any(file.explode(.),
                  length(.scan.pdf.urls) == 1
                  and any(.scan.pdf.urls,
                          strings.contains(.path, '.html')
                          and // links directly to a S3 bucket
                          .domain.root_domain == "amazonaws.com"
                          and strings.icontains(.domain.subdomain, "s3")
                  )
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "PDF"
  - "Free file host"
  - "Evasion"
detection_methods:
  - "File analysis"
  - "Exif analysis"
  - "URL analysis"
id: "86b16409-a40b-5dd8-8589-05fdcf115f89"