Credential phishing: Image as content, short or no body contents

 1name: "Credential phishing: Image as content, short or no body contents"
 2description: |
 3  This rule identifies incoming messages with minimal links, all image attachments and either empty, brief
 4  or the body text is only a warning banner/disclaimer. It also checks for truncated PNG images or logos in addition
 5  to high-confidence credit theft intentions.  
 6type: "rule"
 7severity: "medium"
 8source: |
 9  type.inbound
10  and length(body.links) < 2
11  and 0 < (length(attachments)) < 3
12  and (
13    // body text is very short
14    (
15      0 <= (length(body.current_thread.text)) < 10
16      or body.current_thread.text is null
17    )
18    or (
19      length(body.current_thread.text) < 900
20      // or body is most likely all warning banner (text contains the sender and common warning banner language)
21      and (
22        (
23          strings.contains(body.current_thread.text, sender.email.email)
24          and strings.contains(body.current_thread.text, 'caution')
25        )
26        or regex.icontains(body.current_thread.text,
27                           "intended recipient's use only|external email|sent from outside|you don't often"
28        )
29      )
30    )
31  )
32  and (
33    all(attachments,
34        (.file_type in $file_types_images)
35        and (
36          any(file.explode(.),
37              any(.scan.exiftool.fields, .value == "Truncated PNG image")
38              or (
39                any(ml.logo_detect(..).brands, .name is not null)
40                and any(ml.nlu_classifier(.scan.ocr.raw).intents,
41                        .name == "cred_theft" and .confidence == "high"
42                )
43              )
44          )
45        )
46    )
47  )  
48attack_types:
49  - "Credential Phishing"
50tactics_and_techniques:
51  - "Evasion"
52  - "Image as content"
53detection_methods:
54  - "Computer Vision"
55  - "Content analysis"
56  - "File analysis"
57  - "Header analysis"
58  - "Natural Language Understanding"
59  - "Optical Character Recognition"
60id: "01313f38-d0d1-5240-b407-8f9158639277"