Attachment: PDF with bolded passcode

calendar Sep 8, 2026  ·
Share on: linkedin copy

Detects inbound emails carrying at least one PDF attachment where the HTML body contains a bolded phrase with a distinct RGB color value, and where the text references an upcoming 'code' or 'password'.

Sublime rule (View on GitHub)

 1name: "Attachment: PDF with bolded passcode"
 2description: "Detects inbound emails carrying at least one PDF attachment where the HTML body contains a bolded phrase with a distinct RGB color value, and where the text references an upcoming 'code' or 'password'."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and length(filter(attachments, .file_type == "pdf")) >= 1
 8  and any(html.xpath(body.html, '//div[span/b and span/following-sibling::span]').nodes,
 9          length(distinct(regex.extract(.raw, 'rgb\(.*?\)'), .full_match)) == 2
10          and any(html.xpath(., './/span').nodes,
11                  regex.contains(.inner_text, 'following (code|password|pass):$')
12          )
13  )  
14attack_types:
15  - "Credential Phishing"
16tactics_and_techniques:
17  - "PDF"
18  - "Evasion"
19  - "Social engineering"
20detection_methods:
21  - "HTML analysis"
22  - "Content analysis"
23  - "File analysis"
24id: "f6b680d3-cc80-5039-a14c-5301170c1477"
to-top