High Severity

Attachment: Decoy PDF author (Julie P.)

Labels

Description

This detection rule matches on messages containing one or more Decoy PDF attachments with metadata discovered to have been assoicated with malicious email campaigns featuring CrowdStrike, DocuSign, Human Resource and password expiration lures.

References

No references.

Sublime Security

Created Jul 26th, 2024 • Last updated Apr 29th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and length(attachments) > 0
and any(attachments,
        .size <= 250000
        and .file_extension == "pdf"
        and any(file.explode(.),
                (
                  .scan.exiftool.producer == "DocFly"
                  or any(.scan.exiftool.fields,
                         .key == "XMPToolkit"
                         and strings.icontains(.value, 'DynaPDF')
                  )
                )
                and (
                  any(.scan.exiftool.fields,
                      .key == "CreatorTool"
                      and .value == "Acrobat PDFMaker 24 for Word"
                  )
                  or any(.scan.exiftool.fields,
                         .key == "ContentTypeId"
                         and .value == "2.2388136001807807e+43"
                  )
                  or any(.scan.exiftool.fields,
                         .key == "Creator"
                         and .value in ('Julie Peters', 'Julie Pieters')
                  )
                  or any(.scan.exiftool.fields,
                         .key == "Author"
                         and .value in ('Julie Peters', 'Julie Pieters')
                  )
                )
        )
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.