Attachment: PDF object hash cred phish

calendar Sep 11, 2026  ยท
Share on: linkedin copy

Detects inbound emails containing PDF attachments whose embedded objects match known malicious object hashes observed in cred phish PDFs.

Sublime rule (View on GitHub)

 1name: "Attachment: PDF object hash cred phish"
 2description: "Detects inbound emails containing PDF attachments whose embedded objects match known malicious object hashes observed in cred phish PDFs."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(attachments, .file_type == "pdf"),
 8          any(file.explode(.),
 9              .scan.pdf_obj_hash.object_hash in (
10                "c515d2cb8f93b87bc4891a411ab37e6d",
11                "a67f29d92dd43a924218dc6a437c13d6"
12              )
13          )
14  )  
15attack_types:
16  - "Malware/Ransomware"
17tactics_and_techniques:
18  - "PDF"
19detection_methods:
20  - "File analysis"
21  - "Threat intelligence"
22id: "93572816-27f2-5d36-9388-da090a7635bc"
to-top