Attachment: PDF SSA lure

calendar Nov 12, 2026  ·
Share on: linkedin copy

Detects inbound messages containing PDF attachments that match a YARA signature identifying content associated with Social Security Administration (SSA) themed lures.

Sublime rule (View on GitHub)

 1name: "Attachment: PDF SSA lure"
 2description: "Detects inbound messages containing PDF attachments that match a YARA signature identifying content associated with Social Security Administration (SSA) themed lures."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(attachments, .file_type == "pdf"),
 8          any(file.explode(.), any(.scan.yara.matches, .name == "pdf_ssa_lure"))
 9  )  
10attack_types:
11  - "Credential Phishing"
12tactics_and_techniques:
13  - "PDF"
14  - "Impersonation: Brand"
15  - "Social engineering"
16detection_methods:
17  - "YARA"
18  - "File analysis"
19id: "73b7820d-f833-511c-a8a7-19081b7bf1be"
to-top