Create attachment_pdf_object_hash_partial_match.yml

Author: keaton-sublime

detection-rules/attachment_pdf_object_hash_partial_match.yml

@@ -0,0 +1,19 @@
+name: "Attachment: PDF with specific object hash pattern"
+description: "Detects PDF attachments containing a specific object hash string pattern. This may indicate similar build characteristics or templated features."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and any(filter(attachments, .file_type == "pdf"), 
+      any(file.explode(.),
+          strings.contains(.scan.pdf_obj_hash.hash_string, "Catalog|Pages|Page|Filter|Font/TrueType|FontDescriptor|ExtGState|ExtGState|Font/Type0|None|Font/CIDFontType2|Ordering|FontDescriptor|Font/TrueType|FontDescriptor|Subtype|Subtype|Font/Type0|None|Font/CIDFontType2|Ordering|FontDescriptor|")
+      )   
+  )
+
+attack_types:
+  - "Malware/Ransomware"
+tactics_and_techniques:
+  - "Evasion"
+  - "PDF"
+detection_methods:
+  - "File analysis"