Attachment: PDF with version-only producer and default metadata

calendar Sep 25, 2026  ·
Share on: linkedin copy

Detects PDF attachments whose EXIF producer field contains only a version string (no software or product name) combined with default, anonymized metadata—untitled document, anonymous creator/author, and unspecified subject—and embedded OCR text prompting the recipient to open the document. This combination of an unnamed generation tool, placeholder metadata, and an open-document lure prompt is characteristic of automated PDF-generation kits used in credential phishing and BEC lures.

Sublime rule (View on GitHub)

 1name: "Attachment: PDF with version-only producer and default metadata"
 2description: "Detects PDF attachments whose EXIF producer field contains only a version string (no software or product name) combined with default, anonymized metadata—untitled document, anonymous creator/author, and unspecified subject—and embedded OCR text prompting the recipient to open the document. This combination of an unnamed generation tool, placeholder metadata, and an open-document lure prompt is characteristic of automated PDF-generation kits used in credential phishing and BEC lures."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          .file_type == "pdf"
 9          and any([beta.parse_exif(.)],
10                  regex.imatch(.producer, '[\d.\s()]*\d[\d.\s()]*')
11                  and 2 of (
12                    .title =~ "untitled",
13                    .creator =~ "anonymous",
14                    .author =~ "anonymous",
15                    any(.fields, .key == "Subject" and .value =~ "unspecified")
16                  )
17          )
18          //
19          // This rule makes use of a beta feature and is subject to change without notice
20          // using the beta feature in custom rules is not suggested until it has been formally released
21          //
22          and regex.icontains(beta.ocr(.).text, 'open[\s\S]{0,20}document')
23  )  
24attack_types:
25  - "BEC/Fraud"
26  - "Credential Phishing"
27tactics_and_techniques:
28  - "Image as content"
29  - "Social engineering"
30  - "Evasion"
31detection_methods:
32  - "Exif analysis"
33  - "Optical Character Recognition"
34  - "Content analysis"
35id: "40f73aea-39cf-5a36-a9bc-267bdf0f7cfc"
to-top