Skip to content

Create attachment_pdf_microsoft_purview_impersonation.yml #3476

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 7 commits into from
Nov 10, 2025
Merged

Create attachment_pdf_microsoft_purview_impersonation.yml #3476

merged 7 commits into from
Nov 10, 2025

Conversation

@D-Bolton
Copy link
Member

@D-Bolton D-Bolton commented Nov 4, 2025 •
edited
Loading

Description

Detects pdf attachments that are impersonating Microsoft purview.

Associated samples

Associated hunts

@D-Bolton D-Bolton requested a review from a team as a code owner November 4, 2025 21:26
@github-actions github-actions bot added the in-test-rules PR is in our testing suite to collect telemetry label Nov 4, 2025
github-actions bot added a commit that referenced this pull request Nov 4, 2025
@github-actions
[PR #3476] added rule: Attachment: PDF With Microsoft Purview Message…
dca984a 
… Impersonation
@D-Bolton D-Bolton added the review-needed Indicates that a PR is waiting for review label Nov 5, 2025
github-actions bot added a commit that referenced this pull request Nov 5, 2025
@github-actions
[PR #3476] Delete detection rule
f833f88
github-actions bot added a commit that referenced this pull request Nov 5, 2025
@github-actions
[PR #3476] added rule: Attachment: PDF With Microsoft Purview Message…
0c71a2e 
… Impersonation
@D-Bolton D-Bolton added review-needed Indicates that a PR is waiting for review and removed review-needed Indicates that a PR is waiting for review labels Nov 5, 2025
aidenmitchell
aidenmitchell requested changes Nov 10, 2025
View reviewed changes
D-Bolton and others added 2 commits November 10, 2025 11:37
@D-Bolton @aidenmitchell
Update rule name
a2e312e 
Co-authored-by: Aiden Mitchell <me@aidenmitchell.ca>
@D-Bolton @aidenmitchell
Add standard negation
73db338 
Co-authored-by: Aiden Mitchell <me@aidenmitchell.ca>
github-actions bot added a commit that referenced this pull request Nov 10, 2025
@github-actions
[PR #3476] Delete detection rule
1fa0386
github-actions bot added a commit that referenced this pull request Nov 10, 2025
@github-actions
[PR #3476] added rule: Attachment: PDF with Microsoft Purview message…
5ed4f8a 
… impersonation
@D-Bolton D-Bolton added this pull request to the merge queue Nov 10, 2025
Merged via the queue into main with commit cb566b4 Nov 10, 2025
3 checks passed
@D-Bolton D-Bolton deleted the FN--Credential-phishing-via-PDF-impersonating-Microsoft-protected-messages branch November 10, 2025 18:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@aidenmitchell aidenmitchell aidenmitchell approved these changes

Assignees

No one assigned

Labels

in-test-rules PR is in our testing suite to collect telemetry review-needed Indicates that a PR is waiting for review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@D-Bolton @aidenmitchell