Encrypted Microsoft Office files from untrusted sender

 1name: "Encrypted Microsoft Office files from untrusted sender"
 2description: "Detects encrypted Microsoft Office document attachments (Word, Excel, PowerPoint, Access) from untrusted senders or high-trust senders failing DMARC authentication, which may indicate an effort to bypass security scanning."
 3type: "rule"
 4severity: "medium"
 5source: |
 6    type.inbound
 7    and any(attachments,
 8            (
 9              // Word documents
10              strings.iends_with(.file_name, ".doc")
11              or strings.iends_with(.file_name, ".docx")
12              or strings.iends_with(.file_name, ".docm")
13              or .content_type == "application/msword"
14              or .content_type == "application/vnd.openxmlformats-officedocument.wordprocessingml.document"
15              or .file_type in ("doc", "docx")
16              or 
17    
18              // Excel documents
19              strings.iends_with(.file_name, ".xls")
20              or strings.iends_with(.file_name, ".xlsx")
21              or strings.iends_with(.file_name, ".xlsm")
22              or .content_type == "application/vnd.ms-excel"
23              or .content_type == "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet"
24              or .file_type in ("xls", "xlsx")
25              or 
26    
27              // PowerPoint documents
28              strings.iends_with(.file_name, ".ppt")
29              or strings.iends_with(.file_name, ".pptx")
30              or strings.iends_with(.file_name, ".pptm")
31              or .content_type == "application/vnd.ms-powerpoint"
32              or .content_type == "application/vnd.openxmlformats-officedocument.presentationml.presentation"
33              or .file_type in ("ppt", "pptx")
34              or 
35    
36              // Access documents
37              strings.iends_with(.file_name, ".accdb")
38              or strings.iends_with(.file_name, ".mdb")
39              or .content_type == "application/msaccess"
40              or .content_type == "application/x-msaccess"
41              or .content_type == "application/vnd.ms-access"
42            )
43            and any(file.explode(.),
44                    any(.scan.yara.matches, .name == 'aes_encryption_keywords')
45            )
46    )
47    // Negating high-trust sender domains unless they fail DMARC authentication
48    and not (
49      sender.email.domain.root_domain in $high_trust_sender_root_domains
50      and coalesce(headers.auth_summary.dmarc.pass, false)
51    )    
52tags:
53 - "Attack surface reduction"
54attack_types:
55  - "BEC/Fraud"
56  - "Callback Phishing"
57  - "Credential Phishing"
58  - "Extortion"
59  - "Malware/Ransomware"
60  - "Spam"
61tactics_and_techniques:
62  - "Encryption"
63  - "Evasion"
64detection_methods:
65  - "File analysis"
66  - "YARA"
67  - "Sender analysis"
68id: "eb7b26e7-2e74-5b25-8ecf-7fd401969e03"