KB article 159966, Detect password protected zip files with the Endpoint Prevent Agent, contains a script to detect password protected zip files.
Is there a similar script to detect password protected PDF files?
Release: 15.x, 16.x
We do not have a sample script to detect password-protected PDF files.
Professional Services may be able to create such a custom script.
Creating custom scripts is beyond the scope of support.
Workaround:
From the Adobe website (Password protect a PDF):
"When you use the Acrobat online tool to add password protection to a PDF file, it encrypts the file for added security."
We can detect the encrypted password protected pdf files using the "Message Attachment of File Type match" data identifier.
Encryption Formats > Encrypted Adobe PDF