Attachment: Any .sap file (unsolicited)

 1name: "Attachment: Any .sap file (unsolicited)"
 2description: "SAP shortcut files can be abused to run unsanctioned code on endpoints. Use if receiving .sap files is not normal behavior in your environment."
 3references:
 4  - "https://onapsis.com/blog/sap-shortcut-phishing-threat/"
 5type: "rule"
 6severity: "low"
 7source: |
 8  type.inbound
 9  and any(attachments, .file_extension == "sap")
10  and (
11    not profile.by_sender().solicited
12    or profile.by_sender().any_messages_malicious_or_spam
13  )
14  and not profile.by_sender().any_messages_benign
15  
16  // negate highly trusted sender domains unless they fail DMARC authentication
17  and not (
18    sender.email.domain.root_domain in $high_trust_sender_root_domains
19    and coalesce(headers.auth_summary.dmarc.pass, false)
20  )  
21tags:
22 - "Attack surface reduction"
23attack_types:
24  - "Malware/Ransomware"
25tactics_and_techniques:
26  - "Evasion"
27  - "Scripting"
28detection_methods:
29  - "File analysis"
30  - "Header analysis"
31  - "Sender analysis"
32id: "220ed3de-1b01-54a4-898d-6081785e2870"