Attachment: Encrypted PDF with credential theft body

 1name: "Attachment: Encrypted PDF with credential theft body"
 2description: "Attached PDF is encrypted, and email body contains credential theft language. Seen in-the-wild impersonating e-fax services."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(attachments, .file_type == "pdf"),
 8          any(file.explode(.),
 9              any(.scan.exiftool.fields, .key == "Encryption")
10              or (
11                .scan.entropy.entropy > 7
12                and any(.scan.strings.strings, strings.icontains(., "/Encrypt"))
13              )
14          )
15          // Encrypted PDFs do not have child nodes with any data
16          and all(filter(file.explode(.), .depth > 0), .size == 0)
17  )
18  and (
19    any(ml.nlu_classifier(body.current_thread.text).intents,
20        .name == "cred_theft" and .confidence in ("medium", "high")
21    )
22    or any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
23           .name == "cred_theft" and .confidence in ("medium", "high")
24    )
25    or regex.icontains(body.current_thread.text,
26                       'PDF\s*(?:Access|Preview|Unlock|Decrypt|pass(?:code|word))',
27                       '(Access|Preview|Unlock|Decrypt|Pass)\s*(?:word|code)\s*(?:\S+\s+){0,3}PDF\s*is?\s*:',
28                       'This\s+(?:file|document|pdf)\s+is\s+(?:password[-\s]?)\s+protected\.\s*The\s+password\s+is\s*:?',
29                       '(?:Access|Preview|Unlock|Decrypt)\s+(?:\S+\s+){0,3}(?:PDF|statement)(?:\S+\s+){0,3}(?:pass(?:word|code)|\s*with\s+\S+)',
30                       'The\s+(?:file|document|pdf|attachment)\s+(?:pass(?:code|word)|access\s*code)\s+is\s*'
31    )
32    or (
33      (
34        length(body.current_thread.text) <= 10
35        or (body.current_thread.text is null)
36      )
37      and any(body.previous_threads,
38              regex.icontains(.text,
39                              'PDF\s*(?:Access|Preview|Unlock|Decrypt|pass(?:code|word))',
40                              '(Access|Preview|Unlock|Decrypt|Pass)\s*(?:word|code)\s*(?:\S+\s+){0,3}PDF\s*is?\s*:',
41                              'This\s+(?:file|document|pdf)\s+is\s+(?:password[-\s]?)\s+protected\.\s*The\s+password\s+is\s*:?',
42                              '(?:Access|Preview|Unlock|Decrypt)\s+(?:\S+\s+){0,3}(?:PDF|statement)(?:\S+\s+){0,3}(?:pass(?:word|code)|\s*with\s+\S+)',
43                              'The\s+(?:file|document|pdf|attachment)\s+(?:pass(?:code|word)|access\s*code)\s+is\s*'
44              )
45      )
46    )
47  )
48  // not forwards/replies
49  and not (
50    (length(headers.references) > 0 or headers.in_reply_to is not null)
51    and (subject.is_forward or subject.is_reply)
52    and length(body.previous_threads) >= 1
53  )
54  and (
55    (
56      profile.by_sender_email().prevalence in ("new", "outlier")
57      and not profile.by_sender_email().solicited
58    )
59    or (
60      profile.by_sender_email().any_messages_malicious_or_spam
61      and not profile.by_sender_email().any_messages_benign
62    )
63    or (
64      length(recipients.to) == 0
65      or all(recipients.to,
66             strings.ilike(.display_name, "undisclosed?recipients")
67      )
68    )
69    or (
70      length(recipients.to) == 1
71      and any(recipients.to, .email.email == sender.email.email)
72    )
73  )
74  // negate highly trusted sender domains unless they fail DMARC authentication
75  and (
76    (
77      sender.email.domain.root_domain in $high_trust_sender_root_domains
78      and not headers.auth_summary.dmarc.pass
79    )
80    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
81  )  
82attack_types:
83  - "Credential Phishing"
84tactics_and_techniques:
85  - "Encryption"
86  - "Evasion"
87  - "PDF"
88  - "Social engineering"
89detection_methods:
90  - "Content analysis"
91  - "Exif analysis"
92  - "File analysis"
93  - "Natural Language Understanding"
94  - "Sender analysis"
95id: "c9596c9a-0465-5364-8523-542e6d25a8f7"