← All detection heuristics · CVE
high
CVE likely
CVE_2018_4993
What it means
PDF action target contains a UNC path and the file has action triggers.
Why it fires
CVE-2018-4993 (Adobe Acrobat/Reader) and CVE-2019-7089 allow an attacker to steal NTLM authentication credentials by embedding a UNC path (\\server\share) in a PDF action (JavaScript, GoToR, URI, etc.). When the victim opens the PDF, a vulnerable viewer may resolve the UNC path and Windows can send the user's Net-NTLMv2 hash to the attacker's server. The hash can be cracked offline or used in relay attacks to authenticate as the victim. The rule requires the UNC path to be inside a PDF action target parameter (/F, /URI, /D, or /Target) plus an action keyword such as /JavaScript, /GoToR, /URI, /Launch, /OpenAction, or /AA.
Other CVE heuristics
CVE_2026_34621_RELATED CVE_2023_26369 CVE_2026_34621 CVE_2010_1297_FLASH_RICHMEDIA CVE_2010_1297_SWF_TRIGGER CVE_2011_0611_SWF_TRIGGER CVE_2009_1862_FLASH_RICHMEDIA CVE_2010_2883 CVE_2018_4901 CVE_2009_3459 CVE_2018_4990_JPX_EMBEDDED_CMD CVE_2018_4990_JPX_CMAP_TRIGGER CVE_2010_1240 CVE_2010_0188 CVE_2014_0514 CVE_2013_3346 CVE_2013_0640 CVE_2010_3654_FLASH_RICHMEDIA CVE_2007_5020_MAILTO_MSHTA CVE_2014_0496 CVE_2008_2551 CVE_2021_40444 CVE_2006_4694 CVE_2008_0118