Medium Severity

Attachment: PDF with version-only producer and default metadata

Labels

BEC/Fraud

Credential Phishing

Optical Character Recognition

Content analysis

Description

Detects PDF attachments whose EXIF producer field contains only a version string (no software or product name) combined with default, anonymized metadata—untitled document, anonymous creator/author, and unspecified subject—and embedded OCR text prompting the recipient to open the document. This combination of an unnamed generation tool, placeholder metadata, and an open-document lure prompt is characteristic of automated PDF-generation kits used in credential phishing and BEC lures.

References

No references.

Sublime Security

Created Sep 25th, 2026 • Last updated Sep 25th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(attachments,
        .file_type == "pdf"
        and any([beta.parse_exif(.)],
                regex.imatch(.producer, '[\d.\s()]*\d[\d.\s()]*')
                and 2 of (
                  .title =~ "untitled",
                  .creator =~ "anonymous",
                  .author =~ "anonymous",
                  any(.fields, .key == "Subject" and .value =~ "unspecified")
                )
        )
        //
        // This rule makes use of a beta feature and is subject to change without notice
        // using the beta feature in custom rules is not suggested until it has been formally released
        //
        and regex.icontains(beta.ocr(.).text, 'open[\s\S]{0,20}document')
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.