Attack Patterns

PDF Based

• BadPDF - Bad-Pdf reads the NTLM hashes using Responder listener: https://github.com/deepzec/Bad-Pdf
• Adobe Reader - PDF callback via XSLT stylesheet in XFA: https://insert-script.blogspot.com/2019/01/adobe-reader-pdf-callback-via-xslt.html