Detect password protected PDF files on the DLP Endpoint

Products

• Data Loss Prevention
• Data Loss Prevention Endpoint Prevent

Issue/Introduction

KB article 159966, Detect password protected zip files with the Endpoint Prevent Agent, contains a script to detect password protected zip files.
Is there a similar script to detect password protected PDF files?

Environment

Release: 15.x, 16.x

Resolution

We do not have a sample script to detect password-protected PDF files.
Professional Services may be able to create such a custom script.
Creating custom scripts is beyond the scope of support.

Workaround:

From the Adobe website (Password protect a PDF):

"When you use the Acrobat online tool to add password protection to a PDF file, it encrypts the file for added security."

We can detect the encrypted password protected pdf files using the "Message Attachment of File Type match" data identifier.
Encryption Formats > Encrypted Adobe PDF