Detects inidcators found in PDF files created by Nimbus Manticore (UNC1549). The PDF files usually contain fake job offe

Hunt Hypothesis

This hunt targets UNC1549’s strategy of embedding malicious indicators within deceptive PDF documents that mimic legitimate job offers to trick users into executing malware. Proactively hunting for these specific file artifacts in Azure Sentinel is critical to intercept initial access attempts before they compromise endpoints through social engineering vectors.

YARA Rule

rule SUSP_Nimbus_Manticore_PDF_Indicators_May26 {
   meta:
      description = "Detects inidcators found in PDF files created by Nimbus Manticore (UNC1549). The PDF files usually contain fake job offers or descriptions to lure victims into installing malware."
      author = "Jonathan Peters (Nextron Systems)"
      date = "2026-05-25"
      reference = "https://www.nextron-systems.com/2026/06/01/detecting-nimbus-manticore-and-their-sideloading-infection-chains/"
      hash = "620c51f4376cb79f0109c21971c28661418ae50b119585e3ffdb8011189fcb7b"
      score = 70
   strings:
      $op = { 3C 3C 2F 41 75 74 68 6F 72 28 4A 65 72 72 79 29 20 2F 43 72 65 61 74 6F 72 28 FE FF 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 AE 00 20 00 57 00 6F 00 72 00 64 00 20 00 4C 00 54 00 53 00 43 29 }
   condition:
      1 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

False Positive Guidance

Here are 3-5 specific false positive scenarios for the Nimbus Manticore (UNC1549) detection rule, including suggested filters and exclusions:

Legitimate HR Recruitment Campaigns
- Scenario: The internal Human Resources department uses a third-party recruitment platform (e.g., Greenhouse or Workday) that generates PDF job descriptions containing similar embedded fonts and metadata structures to the malicious Nimbus Manticore tool. When these PDFs are distributed via email to candidates, the detection logic flags them due to matching “fake job offer” content signatures.
- Filter/Exclusion: Create a rule exclusion for PDF files originating from the HR domain (hr.company.com) or specific SMTP senders (e.g., [email protected]). Additionally, exclude any PDF where the Creator metadata field explicitly contains “Workday” or “Greenhouse” instead of “Nimbus Manticore.”
Automated Document Generation by Power Automate
- Scenario: A scheduled Microsoft Power Automate flow runs nightly to compile weekly departmental reports and job summaries into PDFs. If the underlying report template was originally designed using a library similar to Nimbus Manticore, or if the automation tool uses a generic PDF engine that mimics the same header/footer structure, it triggers false alerts on these internal administrative documents.
- Filter/Exclusion: Exclude files generated by the Power Automate service account (e.g., [email protected]) and filter out any detection where the file creation timestamp falls within the defined maintenance window (e.g., 02:00–04:00 UTC) on weekdays.
Internal Knowledge Base Updates
- Scenario: The IT Documentation team uses a specialized tool like Confluence or SharePoint to publish