New Rule: Attachment PDF with link to dmg file download (#785)

Co-authored-by: ID Generator <[email protected]>
Co-authored-by: Josh Kamdjou <[email protected]>

detection-rules/attachment_pdf_link_to_dmg.yml

@@ -0,0 +1,68 @@
+name: "Attachment: PDF with link to DMG file download"
+description: |
+  This rule identifies PDF attachments that either link directly to a DMG file, link to a ZIP archive containing a DMG file, or link to an encrypted ZIP containing a DMG file. This technique has been observed delivering MetaStealer Malware. 
+references:
+  - "https://thehackernews.com/2023/09/beware-metastealer-malware-targets.html"
+  - "https://duo.com/decipher/new-metastealer-malware-targets-macos-users"
+  - "https://www.sentinelone.com/blog/macos-metastealer-new-family-of-obfuscated-go-infostealers-spread-in-targeted-attacks/​"
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and any(attachments,
+          .file_type == "pdf"
+          and any(file.explode(.),
+                  any(.scan.url.urls,
+  
+                      // url links to dmg or zip
+                      (
+                        strings.iends_with(.url, ".dmg") or strings.iends_with(.url, "zip")
+                      )
+  
+                      // and downloads a dmg or a zip
+                      and any(beta.linkanalysis(.).files_downloaded,
+                              (
+                                .file_extension == "dmg"
+                                or (
+                                  .file_extension in~ $file_extensions_common_archives
+  
+                                  // and the zip contains a dmg file
+                                  and any(file.explode(.),
+                                          (.file_extension =~ "dmg")
+  
+                                          // exif inspection if encrypted
+                                          or strings.ends_with(.scan.exiftool.zip_file_name, ".dmg")
+                                  )
+                                )
+                              )
+                      )
+                  )
+          )
+  )
+  
+  
+  // first time sender
+  and (
+    (
+      sender.email.domain.root_domain in $free_email_providers
+      and sender.email.email not in $sender_emails
+    )
+    or (
+      sender.email.domain.root_domain not in $free_email_providers
+      and sender.email.domain.domain not in $sender_domains
+    )
+  )
+tags: 
+  - "Malfam: MetaStealer"
+attack_types:
+  - "Malware/Ransomware"
+tactics_and_techniques:
+  - "Evasion"
+  - "PDF"
+detection_methods:
+  - "Archive analysis"
+  - "Content analysis"
+  - "File analysis"
+  - "URL analysis"
+
+id: "2c486fe0-506d-5498-bb19-dbe58904f9dc"