Attachment: Microsoft OAuth credential harvesting via EML with embedded malicious links
Detects inbound messages containing EML attachments with embedded links targeting Microsoft OAuth authentication flows. The rule identifies suspicious Microsoft login URLs with specific query parameters indicating credential harvesting attempts, including offline access permissions, read/write scopes, and reprocessing endpoints. Links are detected within EML body content, embedded PDF/HTML attachments, and ICS calendar files.
Sublime rule (View on GitHub)
1name: "Attachment: Microsoft OAuth credential harvesting via EML with embedded malicious links"
2description: "Detects inbound messages containing EML attachments with embedded links targeting Microsoft OAuth authentication flows. The rule identifies suspicious Microsoft login URLs with specific query parameters indicating credential harvesting attempts, including offline access permissions, read/write scopes, and reprocessing endpoints. Links are detected within EML body content, embedded PDF/HTML attachments, and ICS calendar files."
3type: "rule"
4severity: "high"
5source: |
6 type.inbound
7 and any(attachments,
8 (.content_type == "message/rfc822" or .file_extension in ("eml"))
9 and (
10 // links in attached EML body
11 any(file.parse_eml(.).body.links,
12 (
13 .href_url.domain.domain in (
14 'login.microsoftonline.com',
15 'login.microsoft.com'
16 )
17 or strings.icontains(.href_url.query_params,
18 "login.microsoftonline.com",
19 'login.microsoft.com'
20 )
21 )
22 and (
23 strings.ilike(.href_url.query_params,
24 '*offline_access*',
25 '*.readwrite*',
26 '*.read*',
27 '*ctx=*',
28 '*prompt=none*'
29 )
30 or (
31 (
32 strings.icontains(.href_url.path, '/common/reprocess')
33 or strings.icontains(.href_url.query_params,
34 "/common/reprocess"
35 )
36 )
37 and strings.icontains(.href_url.query_params, 'ctx=')
38 and strings.icontains(.href_url.query_params, 'sessionId=')
39 )
40 )
41 )
42 // links in PDF and HTML attachments inside the EML
43 or any(filter(file.parse_eml(.).attachments,
44 .file_type in ("pdf", "html", "docx", "pptx")
45 ),
46 any(file.explode(.),
47 any(.scan.url.urls,
48 (
49 .domain.domain in (
50 'login.microsoftonline.com',
51 'login.microsoft.com'
52 )
53 or strings.icontains(.query_params,
54 "login.microsoftonline.com",
55 'login.microsoft.com'
56 )
57 )
58 and (
59 strings.ilike(.query_params,
60 '*offline_access*',
61 '*.readwrite*',
62 '*.read*',
63 '*ctx=*',
64 '*prompt=none*'
65 )
66 or (
67 strings.icontains(.path, '/common/reprocess')
68 and strings.icontains(.query_params, 'ctx=')
69 and strings.icontains(.query_params, 'sessionId=')
70 )
71 )
72 )
73 )
74 )
75 // links in ICS attachments inside the EML
76 or any(filter(file.parse_eml(.).attachments,
77 .file_type == "ics"
78 or .file_extension == "ics"
79 or .content_type in ("application/ics", "text/calendar")
80 ),
81 //
82 // This rule makes use of a beta feature and is subject to change without notice
83 // using the beta feature in custom rules is not suggested until it has been formally released
84 //
85 any(beta.file.parse_ics(.).events,
86 any(.links,
87 (
88 .href_url.domain.domain in (
89 'login.microsoftonline.com',
90 'login.microsoft.com'
91 )
92 or strings.icontains(.href_url.query_params,
93 "login.microsoftonline.com",
94 'login.microsoft.com'
95 )
96 )
97 and (
98 strings.ilike(.href_url.query_params,
99 '*offline_access*',
100 '*.readwrite*',
101 '*.read*',
102 '*ctx=*',
103 '*prompt=none*'
104 )
105 or (
106 strings.icontains(.href_url.path,
107 '/common/reprocess'
108 )
109 and strings.icontains(.href_url.query_params,
110 'ctx='
111 )
112 and strings.icontains(.href_url.query_params,
113 'sessionId='
114 )
115 )
116 )
117 )
118 )
119 )
120 )
121 )
122attack_types:
123 - "Credential Phishing"
124tactics_and_techniques:
125 - "Impersonation: Brand"
126 - "Evasion"
127 - "PDF"
128detection_methods:
129 - "File analysis"
130 - "URL analysis"
131 - "Content analysis"
132related_detections:
133 - "link_office365_suspicious_app_authorization.yml"
134 - "attachment_link_office365_suspicious_app_authorization.yml"
135 - "attachment_ics_link_office365_suspicious_app_authorization.yml"
136 - "link_self_service_platform_link_to_microsoft_redirect.yml"
137id: "6788a4c8-699b-53af-8f2d-5dafcff63843"