EXPLORE DETECTIONS
Attachment: PDF file with embedded content
Threat actors may embed files within PDF documents, including macro-enabled documents, in an attempt to bypass security controls and social engineer a recipient into running malicious code.
Attachment: PDF file with link to fake Bitcoin exchange
Fraudulent message containing a PDF notification of unclaimed Bitcoin assets. The PDF file contains a link to a fake Cryptocurrency portal. Attempting to withdraw funds prompts the user to enter payment information.
Attachment: PDF file with low reputation link to ZIP file (unsolicited)
Detects messages with PDF attachments linking directly to zip files from unsolicited senders.
Attachment: PDF file with low reputation links to suspicious filetypes (unsolicited)
Detects messages with PDF attachments linking directly to suspicious filetypes on hosts with low reputation from unsolicited senders.
Attachment: PDF file with recipient domain and ATT eCheckRun pattern
Detects PDF attachments with filenames containing the recipient's domain, potentially indicating targeted financial document spoofing.
Attachment: PDF generated with wkhtmltopdf tool and default title
Detects PDF attachments that were generated using the wkhtmltopdf conversion tool, which converts HTML/CSS to PDF. This tool is commonly used by attackers to create legitimate-looking PDF documents from web content for social engineering purposes.
Attachment: PDF Grant Payment lure with embedded link
Inbound messages carrying a PDF attachment that references a 'Grant Payment Development' RFP or bid solicitation, often sent from compromised or spoofed education-sector (.k12, .esc) accounts. The PDF contains an embedded URL, consistent with a redirect to a credential-harvesting or malicious landing page disguised as bid documentation.
Attachment: PDF including a Microsoft lure with specific signature
Detects inbound messages containing PDF attachments that match a YARA rule associated with Microsoft-themed lure content.
Attachment: PDF Link With Valueless Base64 Query Parameter
Detects PDF attachments containing embedded URLs whose query strings are base64-like tokens that decode to a single, empty-valued parameter.
Attachment: PDF Object Hash - Encrypted PDF with blue doc icon
Detects inbound messages containing a PDF attachment whose object structure matches a known malicious PDF object hash.
Attachment: PDF Object Hash - Encrypted PDF with proposal bid lure
Detects inbound emails containing PDF attachments whose embedded objects match known malicious object hashes observed in encrypted PDFs with a bid proposal.
Attachment: PDF Object Hash - Encrypted PDFs with fake payment notification
Detects PDF attachments containing a specific object hash (63bf167b66091a4bc53e8944a76f6b08) that may indicate malicious content or known threat indicators.
Attachment: PDF Object Hash - Generic MSFT lure
Detects inbound emails containing PDF attachments where the PDF object hash matches a specific known object hash previously associated with generic Microsoft lures.
Attachment: PDF Object Hash associated with a fake invoice and a W-9
Matching PDF Object Hash associated with a fake invoice followed by a W-9.
Attachment: PDF Object Hash associated with fake Canada Revenue Agency documents
Matching PDF Object Hash associated with chrome -> export to pdf of a shared document related to Canada's Revenue Agency.
Attachment: PDF Object Hash with Blue File Icon
Detects PDF attachments containing a specific object hash (8638ef6bfe382a927aa12a18f2150757) associated with encrypted PDFs leading to cred phishing.
Attachment: PDF proposal with credential theft indicators
PDF attachment with 'proposal' in filename contains sender or recipient domain, credential theft language detected via OCR, and includes a single URL link.
Attachment: PDF RFP lure
Detects inbound messages with PDF attachments that match a YARA signature identifying RFP-themed lure documents with a specific black and white lure.
Attachment: PDF teal SharePoint lure
Detects inbound emails containing PDF attachments that match a yara rule looking for specific teal SharePoint lures.
Attachment: PDF templated investment lure
Detects inbound messages carrying PDF attachments that match a YARA signature for a recurring templated lure using a blue and white design theme.
Attachment: PDF W9 signature reuse
Detects inbound messages containing PDF attachments that match YARA signatures looking for signature re-use.
Attachment: PDF with a suspicious string and single URL
Detects single-page PDF attachments containing suspicious language such as 'View Document' or 'View PDF' along with exactly one URL, commonly used in credential theft attacks.
Attachment: PDF with base64 JavaScript and eval functions
PDF attachment contains base64-encoded JavaScript variables with eval functions, indicating potential code obfuscation and execution techniques commonly used in malicious documents.
Attachment: PDF with blurry lure image
Detects PDF attachments containing a blurry image used in credential phishing lures.