Attachment: PDF file with low reputation link to ZIP file (unsolicited)

 1name: "Attachment: PDF file with low reputation link to ZIP file (unsolicited)"
 2description: |
 3    Detects messages with PDF attachments linking directly to zip files from unsolicited senders.
 4type: "rule"
 5severity: "medium"
 6authors:
 7  - name: "Michael Tingle"
 8source: |
 9  type.inbound
10  and any(ml.nlu_classifier(body.current_thread.text).entities,
11          .name == "request"
12  )
13  and any(attachments,
14          .file_extension == "pdf"
15          and any(file.explode(.),
16                  any(.scan.pdf.urls,
17                      regex.contains(.url, '\.(?:zip)')
18                      and .domain.root_domain not in $tranco_1m
19                  )
20          )
21  )
22  and (
23    not profile.by_sender().solicited
24    or (
25      profile.by_sender().any_messages_malicious_or_spam
26      and not profile.by_sender().any_messages_benign
27    )
28  )  
29tags:
30  - "Malfam: QakBot"
31attack_types:
32  - "Malware/Ransomware"
33tactics_and_techniques:
34  - "Evasion"
35  - "PDF"
36detection_methods:
37  - "Archive analysis"
38  - "File analysis"
39  - "Natural Language Understanding"
40  - "Sender analysis"
41  - "URL analysis"
42id: "d1ee2859-acd1-5c12-9b74-89439ed1eaf1"