Update attachment_encrypted_pdf_cred_theft.yml

[zoomequipd]

Description

Reduce FPs on messages where the attached PDF is not actually encrypted.

When a PDF is actually encrypted, stelka is unable to process any "child" nodes for the PDF. In testing, I found that it does produce a 0 byte "text" object, likely the result of the "extract_text" option not accounting for encrypted PDFs.

All "child" nodes, as determined by a depth > 0, of the root PDF object should have 0 bytes. If any do not have 0 bytes, the PDF is not encrypted.

using all allows for matching when there are no "child" nodes

and all(filter(file.explode(.), .depth > 0), .size == 0)

Associated samples

• Sample 1 - we detected as encrypted but it is readable
• Sample 2 - is actually encrypted and we continue to match

Associated hunts

• Samples that will no longer match

[zoomequipd]

/mql-mimic-exempt: 816293, 816519

both examples are benign and attached PDFs are not encrypted.