Extortion / sextortion in attachment from untrusted sender
Detects extortion and sextortion attempts by analyzing attachment text from an untrusted sender.
Sublime rule (View on GitHub)
1name: "Extortion / sextortion in attachment from untrusted sender"
2description: "Detects extortion and sextortion attempts by analyzing attachment text from an untrusted sender."
3type: "rule"
4severity: "low"
5source: |
6 type.inbound
7 and length(attachments) < 2
8 and (
9 length(body.current_thread.text) < 500
10 or (
11 length(ml.nlu_classifier(body.current_thread.text).intents) > 0
12 and any(ml.nlu_classifier(body.current_thread.text).intents,
13 .name != "benign"
14 )
15 )
16 or regex.icontains(body.html.raw, '<img[^>]+src="cid:')
17 )
18 and any(attachments,
19 // use ocr output from file.explode on pdfs/images
20 (
21 (.file_type in $file_types_images or .file_type == "pdf")
22 and any(filter(file.explode(.), .scan.ocr.raw is not null),
23 (
24 any(ml.nlu_classifier(.scan.ocr.raw).intents,
25 .name == "extortion" and .confidence == "high"
26 )
27 and any(ml.nlu_classifier(.scan.ocr.raw).entities,
28 .name == "financial"
29 )
30 )
31 or 3 of (
32 // malware terms
33 regex.icontains(.scan.ocr.raw,
34 "((spy|mal)ware|trojan|remote control|infiltrat(ed|ion))"
35 ),
36 // actions recorded
37 regex.icontains(.scan.ocr.raw,
38 "porn|adult (web)?site|webcam|masturbating|jerking off|pleasuring yourself|getting off"
39 ),
40 regex.icontains(.scan.ocr.raw,
41 "pervert|perversion|masturbat"
42 ),
43 // a timeframe to pay
44 regex.icontains(.scan.ocr.raw,
45 '\d\d hours',
46 '(?:one|two|three) days?'
47 ),
48 // a promise from the actor
49 regex.icontains(.scan.ocr.raw,
50 'permanently delete|destroy (?:\w+\s*){0,4} (?:data|evidence|videos?)'
51 ),
52 // a threat from the actor
53 regex.icontains(.scan.ocr.raw,
54 'sen[dt]\s*(?:\w+\s*){0,2}\s*to\s*(?:\w+\s*){0,3}\s*.{0,10}(contacts|media|family|friends)'
55 ),
56 // bitcoin
57 (
58 regex.icontains(.scan.ocr.raw,
59 'bitcoin|\bbtc\b|blockchain'
60 )
61 // negate cryptocurrency newsletters
62 and not (
63 any(body.links,
64 strings.icontains(.display_text, "unsubscribe")
65 and (
66 strings.icontains(.href_url.path, "unsubscribe")
67 // handle mimecast URL rewrites
68 or (
69 .href_url.domain.root_domain == 'mimecastprotect.com'
70 and strings.icontains(.href_url.query_params,
71 sender.email.domain.root_domain
72 )
73 )
74 )
75 )
76 )
77 ),
78 // bitcoin wallet address + threat
79 (
80 strings.icontains(.scan.ocr.raw, "contact the police")
81 and regex.icontains(.scan.ocr.raw,
82 '(\b[13][a-km-zA-HJ-NP-Z0-9]{24,33}\b)|\bX[1-9A-HJ-NP-Za-km-z]{33}\b|\b(0x[a-fA-F0-9]{40})\b|\b[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}\b|\b[48][0-9AB][1-9A-HJ-NP-Za-km-z]{93}\b'
83 )
84 ),
85 regex.icontains(.scan.ocr.raw, 'bc1q.{0,50}\b')
86 )
87 )
88 )
89 or
90 // use file.parse_text on plain text files
91 (
92 (
93 .file_extension in ("txt")
94 and (
95 (
96 any(ml.nlu_classifier(file.parse_text(.).text).intents,
97 .name == "extortion" and .confidence == "high"
98 )
99 and any(ml.nlu_classifier(file.parse_text(.).text).entities,
100 .name == "financial"
101 )
102 )
103 or 3 of (
104 // malware terms
105 regex.icontains(file.parse_text(.).text,
106 "((spy|mal)ware|trojan|remote control|infiltrat(ed|ion))"
107 ),
108 // actions recorded
109 regex.icontains(file.parse_text(.).text,
110 "porn|adult (web)?site|webcam|masturbating|jerking off|pleasuring yourself|getting off"
111 ),
112 regex.icontains(file.parse_text(.).text,
113 "pervert|perversion|masturbat"
114 ),
115 // a timeframe to pay
116 regex.icontains(file.parse_text(.).text,
117 '\d\d hours',
118 '(?:one|two|three) days?'
119 ),
120 // a promise from the actor
121 regex.icontains(file.parse_text(.).text,
122 'permanently delete|destroy (?:\w+\s*){0,4} (?:data|evidence|videos?)'
123 ),
124 // a threat from the actor
125 regex.icontains(file.parse_text(.).text,
126 'sen[dt]\s*(?:\w+\s*){0,2}\s*to\s*(?:\w+\s*){0,3}\s*.{0,10}(contacts|media|family|friends)'
127 ),
128 // bitcoin
129 (
130 regex.icontains(file.parse_text(.).text,
131 'bitcoin|\bbtc\b|blockchain'
132 )
133 // negate cryptocurrency newsletters
134 and not (
135 any(body.links,
136 strings.icontains(.display_text, "unsubscribe")
137 and (
138 strings.icontains(.href_url.path, "unsubscribe")
139 // handle mimecast URL rewrites
140 or (
141 .href_url.domain.root_domain == 'mimecastprotect.com'
142 and strings.icontains(.href_url.query_params,
143 sender.email.domain.root_domain
144 )
145 )
146 )
147 )
148 )
149 ),
150 // bitcoin wallet address + threat
151 (
152 strings.icontains(file.parse_text(.).text,
153 "contact the police"
154 )
155 and regex.icontains(file.parse_text(.).text,
156 '(\b[13][a-km-zA-HJ-NP-Z0-9]{24,33}\b)|\bX[1-9A-HJ-NP-Za-km-z]{33}\b|\b(0x[a-fA-F0-9]{40})\b|\b[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}\b|\b[48][0-9AB][1-9A-HJ-NP-Za-km-z]{93}\b'
157 )
158 ),
159 regex.icontains(file.parse_text(.).text, 'bc1q.{0,50}\b')
160 )
161 )
162 )
163 )
164 )
165 and (
166 not profile.by_sender().solicited
167 or (
168 profile.by_sender().any_messages_malicious_or_spam
169 and not profile.by_sender().any_messages_benign
170 )
171 or any(headers.hops, any(.fields, .name == "X-Google-Group-Id"))
172
173 // many extortion emails spoof sender domains and fail sender authentication
174 or any(headers.hops,
175 .authentication_results.dmarc == "fail"
176 or .authentication_results.compauth.verdict not in ("pass", "softpass")
177 )
178 )
179attack_types:
180 - "Extortion"
181tactics_and_techniques:
182 - "Social engineering"
183 - "Spoofing"
184detection_methods:
185 - "Computer Vision"
186 - "Content analysis"
187 - "File analysis"
188 - "Natural Language Understanding"
189 - "Optical Character Recognition"
190 - "Sender analysis"
191id: "3cb8d32c-7c35-5cf9-9a8c-5cb6a1c3bd62"