Attachment: PDF with suspicious link and action-oriented language

 1name: "Attachment: PDF with suspicious link and action-oriented language"
 2description: "Detects PDF attachments containing a single link that leads to pages with language prompting users to view, review, or read documents, accounts, or business-related content such as bids, proposals, agreements, or contracts."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and length(filter(attachments, .file_type == "pdf")) >= 1
 8  and any(attachments,
 9          .file_type == "pdf"
10          and (
11            // a single page pdf
12            beta.parse_exif(.).page_count == 1
13            // in some cases the pdf might have an invalid xref table
14            // so we can instead use the number of pages in the pdf scanner
15            or (
16              beta.parse_exif(.).page_count == 0
17              and any(beta.parse_exif(.).fields,
18                      .key == "Warning" and .value == "Invalid xref table"
19              )
20              and length(filter(file.explode(.),
21                                strings.istarts_with(.file_name, 'pdf_2_png_')
22                         )
23              ) == 1
24            )
25          )
26          and any(file.explode(.),
27                  .depth == 0
28                  // reduce fps by limiting the length to a single link
29                  and length(.scan.url.urls) == 1
30                  and any(filter(.scan.url.urls,
31                                 // remove mailto: links
32                                 not strings.istarts_with(.url, 'mailto:')
33                                 and not strings.istarts_with(.url, 'email:')
34                                 // remove links found in exiftool output
35                                 and not (
36                                   ..scan.exiftool.producer is not null
37                                   and strings.icontains(..scan.exiftool.producer,
38                                                         .domain.domain
39                                   )
40                                 )
41  
42                                 // remove links found in exiftool output
43                                 and not (
44                                   ..scan.exiftool.creator is not null
45                                   and strings.icontains(..scan.exiftool.creator,
46                                                         .domain.domain
47                                   )
48                                 )
49                                 and not .domain.root_domain in ('pdf-tools.com')
50                          ),
51                          (
52                            200 <= ml.link_analysis(.).status_code < 300
53                            and length(ml.link_analysis(.).final_dom.links) < 100
54                            and any(ml.link_analysis(.).final_dom.links,
55                                    .href_url.domain.root_domain != ..domain.root_domain
56                                    and regex.icontains(.display_text,
57                                                        '\b(?:(?:re)?view|see|read|click\s+(?:here\s+)?to)[\t\x20]*(?:\S+[\t\x20]*){0,3}[\t\x20]*(?:document|message|now|proceed)',
58                                                        '\b(?:request|review)\b.{1,5}\b(?:bid|proposal|agreement|portfolio|contract|settlement|invoice)\b',
59                                    )
60                            )
61                          )
62                          or (
63                            200 <= ml.link_analysis(.).status_code < 300
64                            and length(ml.link_analysis(.).final_dom.display_text) < 1050
65                            and regex.icontains(ml.link_analysis(.).final_dom.display_text,
66                                                '\b(?:(?:re)?view|see|read|click\s+(?:here\s+)?to)[\t\x20]*(?:\S+[\t\x20]*){0,3}[\t\x20]*(?:document|message|now|proceed)',
67                                                '\b(?:request|review)\b.{1,5}\b(?:bid|proposal|agreement|portfolio|contract|settlement|invoice)\b'
68                            )
69                            // a common fp in the .au for a payment system
70                            and not strings.icontains(ml.link_analysis(.).final_dom.display_text,
71                                                      'View Podium Message'
72                            )
73                          )
74                          // the title contains high confidence indicators
75                          or any(html.xpath(ml.link_analysis(.).final_dom,
76                                            '//title'
77                                 ).nodes,
78                                 strings.icontains(.raw, 'Secure Document')
79                          )
80                  )
81          )
82  )  
83attack_types:
84  - "Credential Phishing"
85tactics_and_techniques:
86  - "PDF"
87  - "Social engineering"
88  - "Evasion"
89detection_methods:
90  - "File analysis"
91  - "URL analysis"
92  - "Content analysis"
93  - "URL screenshot"
94id: "816d33a0-5217-5b17-a656-f8ce888592cb"