Attachment: Single-page PDF with S3-hosted HTML link

calendar Jul 16, 2026  ·
Share on: linkedin copy

Detects inbound messages containing a single-page PDF attachment that includes exactly one URL, which links directly to an HTML file hosted on an Amazon S3 bucket. This technique is commonly used to redirect recipients to credential harvesting pages while leveraging trusted cloud infrastructure to evade detection.

Sublime rule (View on GitHub)

 1name: "Attachment: Single-page PDF with S3-hosted HTML link"
 2description: "Detects inbound messages containing a single-page PDF attachment that includes exactly one URL, which links directly to an HTML file hosted on an Amazon S3 bucket. This technique is commonly used to redirect recipients to credential harvesting pages while leveraging trusted cloud infrastructure to evade detection."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          .file_type == "pdf"
 9          // a single page pdf
10          and beta.parse_exif(.).page_count == 1
11          and any(file.explode(.),
12                  length(.scan.pdf.urls) == 1
13                  and any(.scan.pdf.urls,
14                          strings.contains(.path, '.html')
15                          and // links directly to a S3 bucket
16                          .domain.root_domain == "amazonaws.com"
17                          and strings.icontains(.domain.subdomain, "s3")
18                  )
19          )
20  )  
21attack_types:
22  - "Credential Phishing"
23tactics_and_techniques:
24  - "PDF"
25  - "Free file host"
26  - "Evasion"
27detection_methods:
28  - "File analysis"
29  - "Exif analysis"
30  - "URL analysis"
31id: "86b16409-a40b-5dd8-8589-05fdcf115f89"
to-top