Service abuse: Task management message sent via SendGrid

 1name: "Service abuse: Task management message sent via SendGrid"
 2description: "Detects messages impersonating task or productivity applications by using 'todo list' in the subject line or body while utilizing SendGrid infrastructure. The sender claims to be task-related through display name or body content but originates from non-legitimate domains without proper DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // subject contains "todo list"
 8  and (
 9    regex.icontains(subject.subject, "T[0o][-\\s]*D[o0][-\\s]*L[I1l]ST")
10    // or we can check the body for todo list content with high cred_theft intent
11    or (
12      regex.icontains(body.current_thread.text,
13                      "T[0o][-\\s]*D[o0][-\\s]*L[I1l]ST"
14      )
15      and any(ml.nlu_classifier(body.current_thread.text).intents,
16              .name == "cred_theft" and .confidence == "high"
17      )
18    )
19  )
20  // utilizing sendgrid infra
21  and headers.return_path.domain.domain == "sendgrid.net"
22  // negate highly trusted sender domains unless they fail DMARC authentication
23  and (
24    (
25      sender.email.domain.root_domain in $high_trust_sender_root_domains
26      and not headers.auth_summary.dmarc.pass
27    )
28    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
29  )
30  and (
31    not profile.by_sender().solicited
32    or (
33      profile.by_sender().any_messages_malicious_or_spam
34      and not profile.by_sender().any_messages_benign
35    )
36  )  
37
38attack_types:
39  - "Credential Phishing"
40tactics_and_techniques:
41  - "Impersonation: Brand"
42  - "Social engineering"
43  - "Evasion"
44detection_methods:
45  - "Content analysis"
46  - "Header analysis"
47  - "Sender analysis"
48id: "568a63f5-dbd2-5f9a-a84a-b4d8aa49c59b"