High Severity
Adobe branded PDF file linking to a password-protected file from untrusted sender
Description
Detects pdf files with links to a remotely hosted password-protected file. This is a common technique abused by Phishing actors as well as Malware actors (IcedID, Remcos, Async Rat)
References
No references.
Sublime Security
Created Aug 17th, 2023 • Last updated Feb 23rd, 2024
Feed Source
Sublime Core Feed
Source
type.inbound
and any(attachments,
.file_extension == "pdf"
and any(file.explode(.),
any(ml.nlu_classifier(.scan.ocr.raw).intents,
.name == "cred_theft" and .confidence == "high"
)
and strings.icontains(.scan.ocr.raw, "password-protected")
and any(ml.nlu_classifier(.scan.ocr.raw).entities,
.name == "org" and .text == "Adobe"
)
)
)
and (
profile.by_sender().prevalence in ("new", "outlier")
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_false_positives
)
)
Playground
Test against your own EMLs or sample data.