Attachment: Fictitious invoice using LinkedIn's address

 1name: "Attachment: Fictitious invoice using LinkedIn's address"
 2description: "Detects PDF attachments created with wkhtmltopdf or Qt that contain LinkedIn's headquarters address (1000 W Maude Ave) in financial communications context, but do not mention LinkedIn itself."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and 0 < length(filter(attachments, .file_type == "pdf")) < 3
 8  and any(filter(attachments,
 9                 .file_type == "pdf"
10                 // creator and producer of PDF seen in malicious content
11                 and (
12                   strings.starts_with(beta.parse_exif(.).creator, "wkhtmltopdf")
13                   or strings.starts_with(beta.parse_exif(.).producer,
14                                          "Qt ",
15                                          "Skia"
16                   )
17                 )
18          ),
19          any(filter(file.explode(.), .scan.ocr.raw is not null),
20              regex.icontains(.scan.ocr.raw, '1000 W(?:est)?\.? Maude Ave')
21          )
22  )
23  // not actually from LinkedIn
24  and not (
25    sender.email.domain.root_domain in ("linkedin.com", "licdn.com")
26    and coalesce(headers.auth_summary.dmarc.pass, false)
27  )
28  and any(ml.nlu_classifier(body.current_thread.text).topics,
29          .name == "Financial Communications" and .confidence != "low"
30  )  
31attack_types:
32  - "BEC/Fraud"
33tactics_and_techniques:
34  - "PDF"
35  - "Social engineering"
36detection_methods:
37  - "File analysis"
38  - "Optical Character Recognition"
39  - "Natural Language Understanding"
40  - "Content analysis"
41  - "Exif analysis"
42id: "aeee3d9f-4b34-5b56-9ac7-81dc3d344489"