Impersonation: Fake Gmail attachment

 1name: "Impersonation: Fake Gmail attachment"
 2description: "Message detects fake Gmail attachments by inspecting the body of a message for elements found within Gmail's user interface for attachment. In expected use, these elements only appears within the gmail WebUI and not within the body of message. The presence of this within message indicates a fake attachment."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any([body.html.display_text, body.current_thread.text, body.plain.raw],
 8          length(.) < 2500
 9          and (
10            strings.icontains(., 'Scanned by Gmail')
11            or (
12              0 < regex.icount(., '\.pdf|\.(doc|xls|ppt)x?') < 3
13              and any(body.links,
14                      regex.icontains(.display_text, 'd[ao0]wnl[ao0]{2}d all')
15              )
16              and length(body.links) < 4
17            )
18          )
19          and regex.icontains(.,
20                              '[KM]b\b'
21          ) // file size
22  )
23  
24  // negate highly trusted sender domains unless they fail DMARC authentication
25  and not (
26    sender.email.domain.root_domain in $high_trust_sender_root_domains
27    and coalesce(headers.auth_summary.dmarc.pass, false)
28  )
29  // if the sender has been marked as malicious, but has FPs, don't alert
30  and (
31    (
32      profile.by_sender().any_messages_malicious_or_spam
33      and not profile.by_sender().any_messages_benign
34    )
35    or not profile.by_sender().any_messages_malicious_or_spam
36  )  
37attack_types:
38  - "Credential Phishing"
39tactics_and_techniques:
40  - "Impersonation: Brand"
41detection_methods:
42  - "Content analysis"
43  - "File analysis"
44  - "Sender analysis"
45id: "0f5a4e14-3a9a-5354-a5d7-faa1268dd4d4"