detection.wiki

Detection rules › Sublime MQL

Attachment: Decoy PDF author (Julie P.)

Severity
high
Type
rule
Source
github.com/sublime-security/sublime-rules

This detection rule matches on messages containing one or more Decoy PDF attachments with metadata discovered to have been assoicated with malicious email campaigns featuring CrowdStrike, DocuSign, Human Resource and password expiration lures.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesImpersonation: Brand, PDF

Event coverage

Message attribute
attachments (collection)
type

Rule body MQL

type.inbound
and length(attachments) > 0
and any(attachments,
        .size <= 250000
        and .file_extension == "pdf"
        and any(file.explode(.),
                (
                  .scan.exiftool.producer == "DocFly"
                  or any(.scan.exiftool.fields,
                         .key == "XMPToolkit"
                         and strings.icontains(.value, 'DynaPDF')
                  )
                )
                and (
                  any(.scan.exiftool.fields,
                      .key == "CreatorTool"
                      and .value == "Acrobat PDFMaker 24 for Word"
                  )
                  or any(.scan.exiftool.fields,
                         .key == "ContentTypeId"
                         and .value == "2.2388136001807807e+43"
                  )
                  or any(.scan.exiftool.fields,
                         .key == "Creator"
                         and .value in ('Julie Peters', 'Julie Pieters')
                  )
                  or any(.scan.exiftool.fields,
                         .key == "Author"
                         and .value in ('Julie Peters', 'Julie Pieters')
                  )
                )
        )
)

Detection logic

Scope: inbound message.

This detection rule matches on messages containing one or more Decoy PDF attachments with metadata discovered to have been assoicated with malicious email campaigns featuring CrowdStrike, DocuSign, Human Resource and password expiration lures.

  1. inbound message
  2. length(attachments) > 0
  3. any of attachments where all hold:
    • .size ≤ 250000
    • .file_extension is 'pdf'
    • any of file.explode(.) where all hold:
      • any of:
        • .scan.exiftool.producer is 'DocFly'
        • any of .scan.exiftool.fields where all hold:
          • .key is 'XMPToolkit'
          • .value contains 'DynaPDF'
      • any of:
        • any of .scan.exiftool.fields where all hold:
          • .key is 'CreatorTool'
          • .value is 'Acrobat PDFMaker 24 for Word'
        • any of .scan.exiftool.fields where all hold:
          • .key is 'ContentTypeId'
          • .value is '2.2388136001807807e+43'
        • any of .scan.exiftool.fields where all hold:
          • .key is 'Creator'
          • .value in ('Julie Peters', 'Julie Pieters')
        • any of .scan.exiftool.fields where all hold:
          • .key is 'Author'
          • .value in ('Julie Peters', 'Julie Pieters')

Inspects: attachments[].file_extension, attachments[].size, type.inbound. Sensors: file.explode, strings.icontains.

Indicators matched (12)

FieldMatchValue
attachments[].file_extensionequalspdf
file.explode(attachments[])[].scan.exiftool.producerequalsDocFly
file.explode(attachments[])[].scan.exiftool.fields[].keyequalsXMPToolkit
strings.icontainssubstringDynaPDF
file.explode(attachments[])[].scan.exiftool.fields[].keyequalsCreatorTool
file.explode(attachments[])[].scan.exiftool.fields[].valueequalsAcrobat PDFMaker 24 for Word
file.explode(attachments[])[].scan.exiftool.fields[].keyequalsContentTypeId
file.explode(attachments[])[].scan.exiftool.fields[].valueequals2.2388136001807807e+43
file.explode(attachments[])[].scan.exiftool.fields[].keyequalsCreator
file.explode(attachments[])[].scan.exiftool.fields[].valuememberJulie Peters
file.explode(attachments[])[].scan.exiftool.fields[].valuememberJulie Pieters
file.explode(attachments[])[].scan.exiftool.fields[].keyequalsAuthor