Attachment: Invoice and W-9 PDFs with suspicious creators

 1name: "Attachment: Invoice and W-9 PDFs with suspicious creators"
 2description: "Detects messages containing two PDF attachments where one has invoice-related naming patterns and another contains W-9 tax form indicators, commonly used in business email compromise attacks targeting financial processes."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and length(distinct(attachments, .sha1)) == 2
 8  and length(filter(attachments, .file_type == "pdf")) == 2
 9  // either of them are chrome/wkhtmltopdf
10  and any(filter(attachments, .file_type == "pdf"),
11          beta.parse_exif(.).creator == "Chromium"
12          or strings.icontains(beta.parse_exif(.).creator, "wkhtmltopdf")
13          or strings.icontains(beta.parse_exif(.).creator, "HeadlessChrome")
14          or (
15            any(beta.parse_exif(.).fields, .key == "Creator" and .value == "")
16            and any(beta.parse_exif(.).fields,
17                    .key == "Producer" and .value == ""
18            )
19          )
20          or any(beta.parse_exif(.).fields,
21                 .key in ("Producer", "CreatorTool")
22                 and regex.icontains(.value, '(?:pdfium|mpdf)')
23          )
24  )
25  and any(attachments,
26          strings.istarts_with(.file_name, 'lnv')
27          or strings.istarts_with(.file_name, 'inv-')
28          or strings.istarts_with(.file_name, "invoice_")
29          or regex.contains(.file_name, '^Invoice\s\d{8,9}')
30          or regex.contains(.file_name, '^INV[0-9]{7}')
31          or regex.contains(.file_name, '^INV#[0-9]{12}')
32          or strings.icontains(beta.ocr(.).text, "Executive Business Coaching")
33          or strings.icontains(beta.ocr(.).text, "Executive Coaching")
34          or strings.icontains(beta.ocr(.).text, "Professional Services")
35          or strings.icontains(beta.ocr(.).text, "Business Systems Integration")
36          or strings.icontains(beta.ocr(.).text, "Consulting & Advisory")
37          or strings.icontains(beta.ocr(.).text, "Zoomlnfo")
38          or (
39            (
40              regex.contains(beta.ocr(.).text, 'INVOICE\s*\n')
41              or regex.icontains(.file_name, '_inv_')
42            )
43            and length(headers.reply_to) > 0
44            and all(headers.reply_to,
45                    .email.domain.root_domain != sender.email.domain.root_domain
46            )
47          )
48  )
49  and any(attachments,
50          .file_name == ".pdf"
51          or regex.contains(beta.ocr(.).text, 'W[=-]9')
52          or regex.icontains(.file_name, 'w[-_]?9')
53  )
54  and not (
55    sender.email.domain.root_domain in ('intuit.com')
56    and coalesce(headers.auth_summary.dmarc.pass, false)
57  )  
58attack_types:
59  - "BEC/Fraud"
60tactics_and_techniques:
61  - "PDF"
62  - "Social engineering"
63  - "Impersonation: Brand"
64detection_methods:
65  - "File analysis"
66  - "Optical Character Recognition"
67  - "Exif analysis"
68  - "Content analysis"
69id: "305d6e32-4104-5007-a209-ee4686081de2"