Execution of Suspicious OIC Invitation PDF via Adobe Acrobat (PlugX)

Kaung Khant Ko@kaungkhantko

•updated Sep 19, 2026•1•0•5

This rule detects the opening of a specific PDF file named 'OIC_Invitation_General_Official.pdf' by Adobe Acrobat. The detection logic triggers either when Acrobat processes this file or when the file itself is identified on the system. This pattern has been associated with the delivery of the PlugX remote access tool, often used in targeted spearphishing campaigns.