Detection Method: Exif analysis
Exif analysis looks at embedded metadata in files to uncover suspicious details that could indicate malicious activity. By extracting and analyzing Exif data from images, documents, PDFs, and other attachments, this method can help spot hidden threats that would normally go undetected.
Exif analysis can detect:
- Document timestamps that don’t match the claimed origin
- Authorship info that conflicts with the sender’s identity
- Signs of image or document manipulation
- Suspicious tools used to create the file
- Geographical data that’s inconsistent with the expected origin
For example, a phishing email claiming to be an invoice might have metadata showing it was created with unauthorized tools, edited recently, or authored by someone outside the company it’s pretending to be from.