Service abuse: Task management message sent via SendGrid

 1name: "Service abuse: Task management message sent via SendGrid"
 2description: "Detects messages impersonating task or productivity applications by using 'todo list' in the subject line or body while utilizing SendGrid infrastructure. The sender claims to be task-related through display name or body content but originates from non-legitimate domains without proper DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // subject contains "todo list"
 8  and (
 9    regex.icontains(subject.subject, "T[0o][-\\s]*D[o0][-\\s]*L[I1l]ST")
10    // or we can check the body for todo list content with high cred_theft intent
11    or (
12      regex.icontains(body.current_thread.text,
13                      "T[0o][-\\s]*D[o0][-\\s]*L[I1l]ST"
14      )
15      and any(ml.nlu_classifier(body.current_thread.text).intents,
16              .name == "cred_theft" and .confidence == "high"
17      )
18    )
19  )
20  // utilizing sendgrid infra
21  and headers.return_path.domain.domain == "sendgrid.net"
22  // negate highly trusted sender domains unless they fail DMARC authentication
23  and not (
24    sender.email.domain.root_domain in $high_trust_sender_root_domains
25    and coalesce(headers.auth_summary.dmarc.pass, false)
26  )
27  and (
28    not profile.by_sender().solicited
29    or (
30      profile.by_sender().any_messages_malicious_or_spam
31      and not profile.by_sender().any_messages_benign
32    )
33  )  
34
35attack_types:
36  - "Credential Phishing"
37tactics_and_techniques:
38  - "Impersonation: Brand"
39  - "Social engineering"
40  - "Evasion"
41detection_methods:
42  - "Content analysis"
43  - "Header analysis"
44  - "Sender analysis"
45id: "568a63f5-dbd2-5f9a-a84a-b4d8aa49c59b"