Attachment: Encrypted PDF with credential phishing link

 1name: "Attachment: Encrypted PDF with credential phishing link"
 2description: "Detects inbound emails containing an encrypted PDF attachment whose cracked password is shared within the email body, and that also includes a small number of embedded URLs flagged for credential theft risk based on newly registered domains or natural language understanding analysis of the link's rendered content."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          any(file.explode(.),
 9              .scan.encrypted_pdf.cracked_password is not null
10              and strings.icontains(body.current_thread.text,
11                                    .scan.encrypted_pdf.cracked_password
12              )
13          )
14          and any(file.explode(.),
15                  length(.scan.url.urls) <= 3
16                  and any(.scan.url.urls,
17                          network.whois(.domain).days_old < 90
18                          or any(ml.nlu_classifier(ml.link_analysis(.,
19                                                                    mode="aggressive"
20                                                   ).final_dom.display_text
21                                 ).intents,
22                                 .name == "cred_theft" and .confidence != "low"
23                          )
24                  )
25          )
26  )  
27attack_types:
28  - "Credential Phishing"
29tactics_and_techniques:
30  - "PDF"
31  - "Encryption"
32  - "Evasion"
33  - "Social engineering"
34detection_methods:
35  - "File analysis"
36  - "Content analysis"
37  - "Whois"
38  - "URL analysis"
39  - "Natural Language Understanding"
40id: "ef904738-1388-56d2-b1a3-81a0eeefaaa1"