Attachment: PDF with secure document acknowledgment prompt

calendar Jul 17, 2026  ยท
Share on: linkedin copy

Detects PDF attachments matching yara rules looking for fake secure document prompts, including acknowledgment-style lures and suspicious image sizing.

Sublime rule (View on GitHub)

 1name: "Attachment: PDF with secure document acknowledgment prompt"
 2description: "Detects PDF attachments matching yara rules looking for fake secure document prompts, including acknowledgment-style lures and suspicious image sizing."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(attachments, .file_type == "pdf"),
 8          any(file.explode(.),
 9              any(.scan.yara.matches,
10                  .name in (
11                    "pdf_prompt_ack_secure_document_link",
12                    "pdf_prompt_ack_secure_document_image_sizes"
13                  )
14              )
15          )
16  )  
17attack_types:
18  - "Credential Phishing"
19tactics_and_techniques:
20  - "Evasion"
21  - "PDF"
22  - "Social engineering"
23  - "Image as content"
24  - "Impersonation: Brand"
25detection_methods:
26  - "Content analysis"
27  - "File analysis"
28  - "YARA"
29id: "00d3962e-370b-54e1-bbfd-41a1e5eb36d5"
to-top