Attachment: PDF with version-only producer and default, anonymized or missing metadata

calendar Nov 10, 2026  ·
Share on: linkedin copy

Detects PDF attachments whose EXIF producer field contains only a version string (no software or product name) combined with default, anonymized or missing metadata—untitled document, anonymous creator/author, and unspecified subject—and embedded OCR text prompting the recipient to open the document. This combination of an unnamed generation tool, placeholder/missing metadata, and an open-document lure prompt is characteristic of automated PDF-generation kits used in credential phishing and BEC lures.

Sublime rule (View on GitHub)

 1name: "Attachment: PDF with version-only producer and default, anonymized or missing metadata"
 2description: "Detects PDF attachments whose EXIF producer field contains only a version string (no software or product name) combined with default, anonymized or missing metadata—untitled document, anonymous creator/author, and unspecified subject—and embedded OCR text prompting the recipient to open the document. This combination of an unnamed generation tool, placeholder/missing metadata, and an open-document lure prompt is characteristic of automated PDF-generation kits used in credential phishing and BEC lures."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(attachments,
 8          .file_type == "pdf"
 9          //
10          // This rule makes use of a beta feature and is subject to change without notice
11          // using the beta feature in custom rules is not suggested until it has been formally released
12          //
13          and any([beta.parse_exif(.)],
14                  regex.imatch(.producer, '[\d.\s()]*\d[\d.\s()]*')
15                  // placeholder or blank document info... exiftool returns "" for absent keys,
16                  // so a stripped info dict satisfies every arm
17                  and 2 of (
18                    .title in~ ("untitled", ""),
19                    .creator in~ ("anonymous", ""),
20                    .author in~ ("anonymous", ""),
21                    (
22                      any(.fields, .key == "Subject" and .value =~ "unspecified")
23                      or not any(.fields, .key == "Subject" and .value != "")
24                    )
25                  )
26          )
27          and regex.icontains(beta.ocr(.).text,
28                              '\bopen(?:s|ed|ing)?\b[\s\S]{0,30}document'
29          )
30  )  
31attack_types:
32  - "BEC/Fraud"
33  - "Credential Phishing"
34tactics_and_techniques:
35  - "Image as content"
36  - "Social engineering"
37  - "Evasion"
38detection_methods:
39  - "Exif analysis"
40  - "Optical Character Recognition"
41  - "Content analysis"
42id: "40f73aea-39cf-5a36-a9bc-267bdf0f7cfc"
to-top