sublimemediumRule

Impersonation: HR administrative center PDF password lure

Detects inbound messages impersonating an internal HR administrative center or company HR department, referencing payroll, policy, or compliance updates. Messages include a numeric case-style identifier in the subject and reference a password-protected PDF attachment, with the decryption password embedded in the body text. Sender display names often use combining diacritical marks or long numeric strings to evade detection, and sending domains are typically unrelated, compromised, or lookalike infrastructure abusing legitimate-looking company names.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003 T1036 T1027

initial-accessdefense-evasion

Detection Query

type.inbound
and (
  (
    (
      strings.contains(body.current_thread.text, '{COMPANYNAME}')
      and strings.contains(body.current_thread.text, '{PDFKEY}')
    )
    and (
      strings.contains(subject.base, '{NUMBER10}')
      or strings.contains(sender.display_name,
                          '{COMPANYNAME}',
                          '{RANDSTRING25}',
                          '{NUMBER10}'
      )
    )
  )
  or (
    (
      regex.icontains(body.current_thread.text,
                      'your_.{1,20}-pdf password\s*=>'
      )
      or regex.icontains(subject.base, 'hr administrative center-\d')
    )
    and (
      regex.count(sender.display_name, '[\x{0300}-\x{036F}]') >= 3
      or regex.icontains(sender.display_name, '\|-1\d{8,}')
    )
  )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Impersonation: HR administrative center PDF password lure"
description: "Detects inbound messages impersonating an internal HR administrative center or company HR department, referencing payroll, policy, or compliance updates. Messages include a numeric case-style identifier in the subject and reference a password-protected PDF attachment, with the decryption password embedded in the body text. Sender display names often use combining diacritical marks or long numeric strings to evade detection, and sending domains are typically unrelated, compromised, or lookalike infrastructure abusing legitimate-looking company names."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and (
    (
      (
        strings.contains(body.current_thread.text, '{COMPANYNAME}')
        and strings.contains(body.current_thread.text, '{PDFKEY}')
      )
      and (
        strings.contains(subject.base, '{NUMBER10}')
        or strings.contains(sender.display_name,
                            '{COMPANYNAME}',
                            '{RANDSTRING25}',
                            '{NUMBER10}'
        )
      )
    )
    or (
      (
        regex.icontains(body.current_thread.text,
                        'your_.{1,20}-pdf password\s*=>'
        )
        or regex.icontains(subject.base, 'hr administrative center-\d')
      )
      and (
        regex.count(sender.display_name, '[\x{0300}-\x{036F}]') >= 3
        or regex.icontains(sender.display_name, '\|-1\d{8,}')
      )
    )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Impersonation: Brand"
  - "PDF"
  - "Social engineering"
  - "Evasion"
detection_methods:
  - "Content analysis"
  - "Header analysis"
  - "Sender analysis"
id: "c28c8fa1-5378-552f-9a0f-c6d186a406dc"