Impersonation: Fake Gmail Attachment

 1name: "Impersonation: Fake Gmail Attachment"
 2description: "Message detects fake Gmail attachments by inspecting the body of a message for elements found within Gmail's user interface for attachment. In expected use, these elements only appears within the gmail WebUI and not within the body of message. The presence of this within message indicates a fake attachment."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any([body.html.display_text, body.current_thread.text, body.plain.raw],
 8          length(.) < 2500 and (
 9          
10            strings.icontains(., 'Scanned by Gmail')
11            or (
12              0 < regex.icount(., '\.pdf|\.(doc|xls|ppt)x?') < 3
13              and any(body.links,
14                      regex.icontains(.display_text, 'd[ao0]wnl[ao0]{2}d all')
15              )
16              and length(body.links) < 4
17            )
18          )
19          and regex.icontains(.,
20                              '[KM]b\b'
21          ) // file size
22  )
23  
24  // negate highly trusted sender domains unless they fail DMARC authentication
25  and (
26    (
27      sender.email.domain.root_domain in $high_trust_sender_root_domains
28      and not headers.auth_summary.dmarc.pass
29    )
30    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
31  )
32  // if the sender has been marked as malicious, but has FPs, don't alert
33  and (
34    (
35      profile.by_sender().any_messages_malicious_or_spam
36      and not profile.by_sender().any_false_positives
37    )
38    or not profile.by_sender().any_messages_malicious_or_spam
39  )  
40attack_types:
41  - "Credential Phishing"
42tactics_and_techniques:
43  - "Impersonation: Brand"
44detection_methods:
45  - "Content analysis"
46  - "File analysis"
47  - "Sender analysis"
48id: "0f5a4e14-3a9a-5354-a5d7-faa1268dd4d4"