Create attachment_pdf_obj_hash_payment_receipt.yml

detection-rules/attachment_pdf_obj_hash_payment_receipt.yml

@@ -0,0 +1,26 @@
+name: "Attachment: PDF object hash - payment receipt theme"
+description: "Detects PDF attachments containing objects with specific hash values known for fake payment receipts and invoice confirmations. The rule identifies PDF files by analyzing their internal object structures and matching against known, harmful object hashes."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and any(filter(attachments, .file_type == "pdf"),
+          any(file.explode(.),
+              .scan.pdf_obj_hash.object_hash in (
+                "4f5f997e942b2ae810c6a1a08102bae9",
+                "50ba355ed44086ef6507630ebd32d07d",
+                "9c6b9dcddee56a38f1be7badaef017a2",
+                "b0c61dbe486d697f0079cbd63d06bbfc"
+              )
+          )
+  )
+
+attack_types:
+  - "BEC/Fraud"
+tactics_and_techniques:
+  - "PDF"
+  - "Evasion"
+detection_methods:
+  - "File analysis"
+  - "Threat intelligence"
+id: "e9d5be49-d7f0-5ef4-a931-9d3122aa9322"