From afd83c5bc28bd707e2a1f443963fe66e906d2b11 Mon Sep 17 00:00:00 2001 From: missingn0pe Date: Fri, 17 Jul 2026 14:16:59 -0500 Subject: [PATCH] fix: expand encrypted PDF password regex to catch FN (ESC-17540) Updated the regex pattern in attachment_encrypted_pdf_cred_theft rule to detect both "PDF passcode" and "PDF password" variants. Changed from literal "passcode" to regex group pass(?:code|word) for broader coverage of credential theft lures. Fixes false negative where attacks use "password" instead of "passcode". Co-Authored-By: Claude Sonnet 4.5 --- detection-rules/attachment_encrypted_pdf_cred_theft.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detection-rules/attachment_encrypted_pdf_cred_theft.yml b/detection-rules/attachment_encrypted_pdf_cred_theft.yml index 69422fcf006..bf2ddbf8352 100644 --- a/detection-rules/attachment_encrypted_pdf_cred_theft.yml +++ b/detection-rules/attachment_encrypted_pdf_cred_theft.yml @@ -23,7 +23,7 @@ source: | .name == "cred_theft" and .confidence in ("medium", "high") ) or regex.icontains(body.current_thread.text, - 'PDF\s*(?:Access|Preview|Unlock|Decrypt|passcode)', + 'PDF\s*(?:Access|Preview|Unlock|Decrypt|pass(?:code|word))', '(Access|Preview|Unlock|Decrypt|Pass)\s*(?:word|code)\s*(?:\S+\s+){0,3}PDF\s*is?\s*:', 'This\s+(?:file|document|pdf)\s+is\s+(?:password[-\s]?)\s+protected\.\s*The\s+password\s+is\s*:?', '(?:Access|Preview|Unlock|Decrypt)\s+(?:\S+\s+){0,3}(?:PDF|statement)(?:\S+\s+){0,3}(?:pass(?:word|code)|\s*with\s+\S+)' @@ -35,7 +35,7 @@ source: | ) and any(body.previous_threads, regex.icontains(.text, - 'PDF\s*(?:Access|Preview|Unlock|Decrypt|passcode)', + 'PDF\s*(?:Access|Preview|Unlock|Decrypt|pass(?:code|word))', '(Access|Preview|Unlock|Decrypt|Pass)\s*(?:word|code)\s*(?:\S+\s+){0,3}PDF\s*is?\s*:', 'This\s+(?:file|document|pdf)\s+is\s+(?:password[-\s]?)\s+protected\.\s*The\s+password\s+is\s*:?', '(?:Access|Preview|Unlock|Decrypt)\s+(?:\S+\s+){0,3}(?:PDF|statement)(?:\S+\s+){0,3}(?:pass(?:word|code)|\s*with\s+\S+)'