Link: Multistage landing - Abused Adobe Acrobat hosted PDF

 1name: "Link: Multistage landing - Abused Adobe Acrobat hosted PDF"
 2description: "Detects an inbound message containing an Adobe Acrobat link that leads to a single page PDF document with suspicious indicators, including minimal text, brand logos, document viewer language, and the message is not a reply."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.domain == "acrobat.adobe.com"
 9          and strings.istarts_with(.href_url.path, '/id/urn:')
10  )
11  and length(distinct(filter(body.links,
12                             .href_url.domain.domain == "acrobat.adobe.com"
13                             and strings.istarts_with(.href_url.path, '/id/urn:')
14                      ),
15                      .href_url.url
16             )
17  ) == 1
18  and any(filter(body.links,
19                 .href_url.domain.domain == "acrobat.adobe.com"
20                 and strings.istarts_with(.href_url.path, '/id/urn:')
21          ),
22          any(ml.link_analysis(., mode="aggressive").additional_responses,
23              (
24                any(file.explode(.file),
25                    any(.scan.exiftool.fields,
26                        // password protected pdf
27                        .key == "Warning"
28                        and strings.icontains(.value, "password protected")
29                    )
30                )
31                // a low amount of links
32                or (
33                  any(file.explode(.file), 1 <= length(.scan.url.urls) <= 2)
34                  // a single page
35                  and any(file.explode(.file),
36                          .scan.exiftool.page_count == 1
37                          // occurs when there are exif errors
38                          or .scan.exiftool.page_count is null
39                  )
40                  // susipicious indicators
41                  and (
42                    // logo detection of brands for file sharing companies
43                    any(ml.logo_detect(.file).brands,
44                        .name in ("DocuSign", "Adobe")
45                        or strings.istarts_with(.name, 'Microsoft')
46                    )
47                    // look at the OCR of the document as well
48                    or (
49                      length(beta.ocr(.file).text) < 750
50                      and (
51                        regex.icontains(beta.ocr(.file).text, 'e-sign(?:ature)?')
52                        or strings.icontains(beta.ocr(.file).text,
53                                             'shared a document',
54                                             'review and sign',
55                                             'PDF viewer',
56                                             "display this type of document",
57                                             'please wait...',
58                                             'New PDF Document',
59                                             'view document',
60                                             'open the secure review session'
61                        )
62                      )
63                    )
64                  )
65                )
66              )
67          )
68  )
69  and length(headers.references) == 0
70  and headers.in_reply_to is null  
71attack_types:
72  - "Credential Phishing"
73tactics_and_techniques:
74  - "Impersonation: Brand"
75  - "Social engineering"
76detection_methods:
77  - "Computer Vision"
78  - "Optical Character Recognition"
79  - "URL analysis"
80  - "Header analysis"
81  - "Sender analysis"
82id: "609081ef-ca1a-577f-a886-a590e39655eb"