EXPLORE DETECTIONS
Attachment: PDF with self-service platform links with self sender or blank recipients
Detects single-page PDF attachments containing links to self-service content creation platforms, sent to either the sender's own email address or an invalid email domain. This pattern may indicate testing of malicious content or preparation for distribution.
Attachment: PDF with specific author metadata
Detects inbound messages containing PDF attachments where the EXIF metadata indicates the author or creator is 'Shelby Porter'.
Attachment: PDF with specific blurred lure
Detects inbound messages containing PDF attachments that match YARA signatures for a specific blurred document lure.
Attachment: PDF with specific W-9 lure
Detects PDF attachments containing W-9 related lures. This one is looking for signatures that have been observed across multiple samples.
Attachment: PDF with split QR code
Detects PDF attachments containing split QR codes positioned close together, a technique used to evade detection while maintaining QR code functionality for credential theft.
Attachment: PDF with suspicious document view lure
Detects PDF attachments containing a title box designed to lure recipients into viewing a document, a common social engineering technique used to direct users to malicious content.
Attachment: PDF with suspicious HeadlessChrome metadata
Detects PDF attachments created by HeadlessChrome with suspicious characteristics, including MD5-formatted HTML filenames or blank titles with Windows Skia/PDF producer, excluding legitimate Google Docs files.
Attachment: PDF with suspicious internal object reference identifier
Detects inbound messages containing PDF attachments with a specific internal object reference identifier pattern, which may indicate a crafted or malicious PDF file.
Attachment: PDF with suspicious language and redirect to suspicious file type
Attached PDF contains credential theft language, and links to an open redirect to a suspicious file type. This has been observed in-the-wild as a Qakbot technique.
Attachment: PDF with suspicious link and action-oriented language
Detects PDF attachments containing a single link that leads to pages with language prompting users to view, review, or read documents, accounts, or business-related content such as bids, proposals, agreements, or contracts.
Attachment: PDF with suspicious view document characteristics
PDF attachment contains suspicious characteristics commonly associated with document viewing lures, as detected by YARA pattern matching.
Attachment: PDF with version-only producer and default metadata
Detects PDF attachments whose EXIF producer field contains only a version string (no software or product name) combined with default, anonymized metadata—untitled document, anonymous creator/author, and unspecified subject—and embedded OCR text prompting the recipient to open the document. This combination of an unnamed generation tool, placeholder metadata, and an open-document lure prompt is characteristic of automated PDF-generation kits used in credential phishing and BEC lures.
Attachment: PDF with View RFP Document lure with external link
Detects inbound emails containing a PDF attachment that references a 'VIEW RFP DOCUMENT' lure and embeds a URL pointing to a domain that differs from the sender's domain, a pattern consistent with document-based social engineering used to redirect recipients to attacker-controlled infrastructure.
Attachment: PDF with W-9 form indicators
Detects inbound messages containing PDF attachments that match structural or signature patterns consistent with specific W-9 tax lure activity sets.
Attachment: Personalized fake order/invoice file naming pattern
Detects inbound messages from free webmail senders with fake order confirmation or overdue invoice lures, carrying an attachment whose file name is dynamically personalized with the recipient's email local part and follows a structured pattern (date-like prefix, recipient identifier, and an alphanumeric code). This naming convention is used to make the attachment appear as a legitimate, individually generated invoice or receipt tailored to the target.
Attachment: Potential sandbox evasion in Office file
Scans attached files with known Office file extension, and alerts on the presence of strings indicative of sandbox evasion checks. Malicious code may carry out checks against the local host (e.g. running processes, disk size, domain-joined status) before running its final payload.
Attachment: PowerPoint with suspicious hyperlink
Attached PowerPoint contains a suspicious hyperlink that can execute arbitrary code.
Attachment: PowerShell content
Recursively scans files and archives to detect PowerShell content. While scripts are often blocked by mail filtering, alternative file formats and archived content may be employed to bypass such controls.
Attachment: Python generated PDF with link
The PDF attachment was created with a Python-based script and contains one or more links. These techniques were used by PikaBot, among others.
Attachment: QR code link with encoded recipient address
Detects when an image or macro attachment contains QR codes that, when scanned, lead to URLs containing the recipient's email address. This tactic is used to uniquely track or target specific recipients and serve tailored credential phishing pages.
Attachment: QR code with credential phishing indicators
Detects messages with between 1-3 attachments containing a QR code with suspicious credential theft indicators, such as: LinkAnalysis credential phishing conclusion, decoded QR code url traverses suspicious infrastructure, the final destination is in URLhaus, decoded URL downloads a zip or executable, leverages URL shorteners, known QR abused openredirects, and more.
Attachment: QR code with encoded recipient targeting and redirect indicators
Detects QR codes in attachments that contain the recipient's email address (either plaintext or base64 encoded) and redirect through suspicious URI structures commonly associated with Kratos/SneakyLog redirection services.
Attachment: QR code with recipient targeting and special characters
Detects messages with QR code in attachments containing special characters in the path that include the recipient's email address in either the URL path or fragment, potentially encoded in base64. The URLs have a simple path structure and may end with suspicious patterns.
Attachment: QR code with suspicious URL patterns in EML file
Detects EML attachments containing QR codes that link to URLs with suspicious patterns, including specific alphanumeric combinations in subdomains and paths, or special characters followed by encoded terminators. These patterns are commonly used to evade detection in credential theft attacks.