Attachment: Decoy PDF author (Julie P.)

calendar Apr 29, 2026  ·
Share on: linkedin copy

This detection rule matches on messages containing one or more Decoy PDF attachments with metadata discovered to have been assoicated with malicious email campaigns featuring CrowdStrike, DocuSign, Human Resource and password expiration lures.

Sublime rule (View on GitHub)

 1name: "Attachment: Decoy PDF author (Julie P.)"
 2description: "This detection rule matches on messages containing one or more Decoy PDF attachments with metadata discovered to have been assoicated with malicious email campaigns featuring CrowdStrike, DocuSign, Human Resource and password expiration lures."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and length(attachments) > 0
 8  and any(attachments,
 9          .size <= 250000
10          and .file_extension == "pdf"
11          and any(file.explode(.),
12                  (
13                    .scan.exiftool.producer == "DocFly"
14                    or any(.scan.exiftool.fields,
15                           .key == "XMPToolkit"
16                           and strings.icontains(.value, 'DynaPDF')
17                    )
18                  )
19                  and (
20                    any(.scan.exiftool.fields,
21                        .key == "CreatorTool"
22                        and .value == "Acrobat PDFMaker 24 for Word"
23                    )
24                    or any(.scan.exiftool.fields,
25                           .key == "ContentTypeId"
26                           and .value == "2.2388136001807807e+43"
27                    )
28                    or any(.scan.exiftool.fields,
29                           .key == "Creator"
30                           and .value in ('Julie Peters', 'Julie Pieters')
31                    )
32                    or any(.scan.exiftool.fields,
33                           .key == "Author"
34                           and .value in ('Julie Peters', 'Julie Pieters')
35                    )
36                  )
37          )
38  )  
39attack_types:
40  - "Credential Phishing"
41tactics_and_techniques:
42  - "Impersonation: Brand"
43  - "PDF"
44detection_methods:
45  - "File analysis"
46  - "Content analysis"
47id: "4324213a-7f8e-5556-95e3-1ab4037d9b83"
to-top