EXPLORE DETECTIONS
Attachment: PDF with bolded passcode
Detects inbound emails carrying at least one PDF attachment where the HTML body contains a bolded phrase with a distinct RGB color value, and where the text references an upcoming 'code' or 'password'.
Attachment: PDF with credential theft language and invalid reply-to domain
Detects PDF attachments containing high-confidence credential theft language that references the recipient's email address, combined with an invalid reply-to domain header.
Attachment: PDF with credential theft language and link to a free subdomain (unsolicited)
Detects messages with credential theft PDFs linking to free subdomains.
Attachment: PDF with CVE-2026-34621 lures
Detects PDF attachments containing YARA signatures associated with CVE-2026-34621's observed lures.
Attachment: PDF with dub.sh shortened link
Catches messages carrying PDF attachments that embed links shortened through the dub.sh service. The lures vary widely, from fake 'password protected document' or e-signature notifications to business submission and proposal requests, but each relies on a PDF containing a shortened link to obscure the true destination and evade URL-based filtering.
Attachment: PDF with eCheckRun lures
Detects PDF attachments matching yara rules looking for attachments containing artifacts from related to fake financial/invoice themes, including eCheckRun lures. These are commonly used to trick users into believe they have received legitmate electronic payment messages.
Attachment: PDF with embedded box-lure and javascript
Detects inbound messages containing a PDF attachment that matches YARA signatures looking for JavaScript functions or specific lure boxes that have been observed within malicious documents.
Attachment: PDF with embedded Javascript
PDF contains embedded Javascript.
Attachment: PDF with EOF MD5 hash marker
Detects inbound messages containing a PDF attachment whose contents match a YARA signature identifying an MD5 hash appended near the end of file. This technique is commonly used to make each generated PDF unique, helping evade hash-based detection systems.
Attachment: PDF with fake invoice using suspicious font sizing
PDF attachment contains a fake invoice with suspicious font size patterns and unique image sizes, typically used in fraudulent billing schemes.
Attachment: PDF with JSFck obfuscation
PDF attachment contains JavaScript obfuscated using JSFck encoding techniques. JSFck is a method of writing JavaScript code using only six characters: []()!+ which is often used to evade detection by security tools.
Attachment: PDF with link to DMG file download
This rule identifies PDF attachments that either link directly to a DMG file, link to a ZIP archive containing a DMG file, or link to an encrypted ZIP containing a DMG file. This technique has been observed delivering MetaStealer Malware.
Attachment: PDF with link to zip containing a wsf file
Detects a PDF attachment with a link to a ZIP file that contains a WSF file
Attachment: PDF with localhost IP in EXIF title metadata
Detects inbound PDF attachments where the EXIF title metadata starts with '127.0.0.1', sent either to a self-addressed recipient or an invalid recipient domain. This technique may indicate automated or malicious document generation tools embedding localhost references in file metadata.
Attachment: PDF with Microsoft Purview message impersonation
Detects PDF attachments containing text that impersonates Microsoft Purview secure message notifications, potentially used to trick users into believing they have received legitimate secure communications from Microsoft services.
Attachment: PDF with multistage landing - ClickUp abuse
Detects PDF attachments containing ClickUp document links that either redirect to unavailable pages or contain embedded links leading to newly registered domains, free file hosts, URL shorteners, or verified credential theft pages.
Attachment: PDF with password in filename matching body text
Detects messages containing a single PDF attachment where the filename includes a numeric password that is explicitly referenced in the message body text.
Attachment: PDF with personal Microsoft OneNote URL
Detects PDF attachments containing a sharepoint URL referencing the senders personal OneNote.
Attachment: PDF with QR code containing recipient-specific credential theft content
Detects PDF attachments containing QR codes that include the recipient's email address (either plaintext or base64 encoded) combined with credential theft language detected through natural language processing. This technique personalizes the attack by incorporating the target's email into the QR code URL while using PDF content to establish credibility.
Attachment: PDF with quote lure
Detects PDF attachments containing quote-themed lure content.
Attachment: PDF with recipient email in link
Detects PDF attachments that contain the recipient's domain in the filename and include a link personalized with the recipient's email address, either in the URL directly, encoded in base64, or within a QR code.
Attachment: PDF with ReportLab library and default metadata
Detects PDF attachments generated using the ReportLab PDF Library with default anonymous metadata values, including untitled document, anonymous creator/author, and unspecified subject. This combination of characteristics is commonly associated with automated PDF generation tools used in malicious activities.
Attachment: PDF With SAI Global ISO9001 Logo
Detects PDF attachments containing embedded SAI Global ISO9001 logos, which may indicate brand impersonation or fraudulent certification claims.
Attachment: PDF with secure document acknowledgment prompt
Detects PDF attachments matching yara rules looking for fake secure document prompts, including acknowledgment-style lures and suspicious image sizing.