sublimemediumRule

Attachment: Adobe Sign lure PDF with embedded banner images

Detects inbound messages containing PDF attachments that contain embedded banner images mimicking Adobe Sign branding, commonly used to deceive recipients into believing the document is legitimate.

MITRE ATT&CK

T1566 T1566.001 T1566.002 T1598 T1598.003

initial-access

Detection Query

type.inbound
and any(filter(attachments, .file_type == "pdf"),
        any(file.explode(.),
            any(.scan.yara.matches, .name == 'adobe_sign_lure_banner_images')
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Attachment: Adobe Sign lure PDF with embedded banner images"
description: "Detects inbound messages containing PDF attachments that contain embedded banner images mimicking Adobe Sign branding, commonly used to deceive recipients into believing the document is legitimate."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(filter(attachments, .file_type == "pdf"),
          any(file.explode(.),
              any(.scan.yara.matches, .name == 'adobe_sign_lure_banner_images')
          )
  )
attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "PDF"
  - "Impersonation: Brand"
detection_methods:
  - "File analysis"
  - "YARA"
id: "f27f40ff-3349-50a6-ade3-182b069775c2"