Sublime Security high experimental mql

Attachment: Soda PDF producer with encryption themes

Detects an observed TTP of using Soda PDF (which offers a free trial) to produce PDFs which OCR output contains references to encryption and mentions a PDF. The PDF contains a single link which has been observed linking to a credential phishing page.

View Source

Detection Logic

type.inbound
and any(attachments,
        .file_extension == "pdf"
        // observed producer
        and any(file.explode(.), .scan.exiftool.producer == "Soda PDF")
        and any(file.explode(.),
                // OCR contains "encryption" themes
                (
                  strings.icontains(.scan.ocr.raw, "has been encrypted")
                  or strings.icontains(.scan.ocr.raw, "encrypted pdf file")
                  or strings.icontains(.scan.ocr.raw, "is secured by")
                )
                // mentions a PDF 
                and strings.contains(.scan.ocr.raw, "PDF")
        )
)

Field Validations

Loading…

Comments (0)

Loading comments...