Adobe Acrobat Reader Hijack for Persistence

This threat focuses on the potential hijacking of Adobe Acrobat Reader by replacing its RdrCEF.exe executable with a malicious file. This technique allows attackers to establish persistence on a compromised system. When a user launches Adobe Acrobat Reader, the replaced RdrCEF.exe is executed, granting the attacker continued access. This is a potential persistence mechanism which could allow for the deployment of malware, exfiltration of data, or further compromise of the system. The original detection rule was created in February 2020 and has been updated multiple times with the last update on April 7, 2026.

Attack Chain

1. The attacker gains initial access to the system, potentially through exploiting a vulnerability or social engineering.
2. The attacker identifies the location of the RdrCEF.exe file within the Adobe Acrobat Reader installation directory (e.g., C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe).
3. The attacker replaces the legitimate RdrCEF.exe file with a malicious executable. This could involve renaming the original file and placing the malicious file in its place, or overwriting the original file directly.
4. The attacker ensures the malicious executable has the same name as the original RdrCEF.exe file.
5. A user launches Adobe Acrobat Reader.
6. The operating system executes the RdrCEF.exe file as part of Adobe Acrobat Reader's startup process.
7. Because the file has been replaced with a malicious executable, the attacker's code is executed.
8. The attacker maintains persistent access to the system and can perform further actions such as deploying malware or exfiltrating data.

Impact

Successful exploitation of this technique allows attackers to maintain persistence on compromised systems. This can lead to the deployment of ransomware, exfiltration of sensitive data, or further exploitation of the system. The severity is low, but impact can be high, if the adversary uses this technique to gain further access to the compromised system.

Recommendation

• Deploy the Sigma rule "Adobe Acrobat Reader Hijack for Persistence" to your SIEM to detect the replacement of the RdrCEF.exe file.
• Monitor file creation events in the Adobe Acrobat Reader installation directories for suspicious executables using Sysmon or another EDR solution.
• Regularly audit file integrity within the Adobe Acrobat Reader installation directory to identify unauthorized modifications.
• Investigate any alerts generated by the Sigma rules or other detection mechanisms to determine if a system has been compromised.