sublimemediumRule

Link: PDF file disguised as HTML page

Detects inbound messages containing links that appear to reference PDF files but are actually HTML pages, indicated by URLs ending with '.pdf' followed by additional characters and '.html'. This technique is commonly used to bypass security filters and deceive recipients into believing they are accessing a legitimate PDF document.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1204.002 T1486 T1036 T1027

defense-evasion

Detection Query

type.inbound
and any(body.current_thread.links,
        regex.icontains(.href_url.path, '\.pdf[^/]*\.html$')
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Link: PDF file disguised as HTML page"
description: "Detects inbound messages containing links that appear to reference PDF files but are actually HTML pages, indicated by URLs ending with '.pdf' followed by additional characters and '.html'. This technique is commonly used to bypass security filters and deceive recipients into believing they are accessing a legitimate PDF document."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(body.current_thread.links,
          regex.icontains(.href_url.path, '\.pdf[^/]*\.html$')
  ) 
attack_types:
  - "Credential Phishing"
  - "Malware/Ransomware"
tactics_and_techniques:
  - "Evasion"
  - "PDF"
detection_methods:
  - "URL analysis"
  - "Content analysis"
id: "aa1a842d-ddd9-5e0e-8f17-bbcab4818195"