Attachment: Decoy PDF Author (Julie P.)

calendar Oct 2, 2024  ·
Share on: linkedin copy

This detection rule matches on messages containing one or more Decoy PDF attachments with metadata discovered to have been assoicated with malicious email campaigns featuring CrowdStrike, DocuSign, Human Resource and password expiration lures.

Sublime rule (View on GitHub)

 1name: "Attachment: Decoy PDF Author (Julie P.)"
 2description: "This detection rule matches on messages containing one or more Decoy PDF attachments with metadata discovered to have been assoicated with malicious email campaigns featuring CrowdStrike, DocuSign, Human Resource and password expiration lures."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and length(attachments) > 0
 8  and any(attachments,
 9          .size <= 250000
10          and .file_extension == "pdf"
11          and any(file.explode(.),
12                  (
13                    .scan.exiftool.producer == "DocFly"
14                    or any(.scan.exiftool.fields,
15                           .key == "XMPToolkit"
16                           and strings.icontains(.value, 'DynaPDF')
17                    )
18                  )
19                  and (
20                    any(.scan.exiftool.fields,
21                        .key == "CreatorTool"
22                        and .value == "Acrobat PDFMaker 24 for Word"
23                    )
24                    or any(.scan.exiftool.fields,
25                           .key == "ContentTypeId"
26                           and .value == "2.2388136001807807e+43"
27                    )
28                    or any(.scan.exiftool.fields,
29                           .key == "Creator"
30                           and .value in ('Julie Peters', 'Julie Pieters')
31                    )
32                    or any(.scan.exiftool.fields,
33                           .key == "Author"
34                           and .value in ('Julie Peters', 'Julie Pieters')
35                    )
36                  )
37          )
38  )
39  and (
40    not profile.by_sender().solicited
41    or (
42      profile.by_sender().any_messages_malicious_or_spam
43      and not profile.by_sender().any_false_positives
44    )
45  )
46  and not profile.by_sender().any_false_positives  
47attack_types:
48  - "Credential Phishing"
49tactics_and_techniques:
50  - "Impersonation: Brand"
51  - "PDF"
52detection_methods:
53  - "File analysis"
54  - "Content analysis"
55  - "Sender analysis"
56id: "4324213a-7f8e-5556-95e3-1ab4037d9b83"
to-top