Impersonation: Fake Gmail Attachment

 1name: "Impersonation: Fake Gmail Attachment"
 2description: "Message detects fake Gmail attachments by inspecting the body of a message for elements found within Gmail's user interface for attachment. In expected use, these elements only appears within the gmail WebUI and not within the body of message. The presence of this within message indicates a fake attachment."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any([body.html.display_text, body.current_thread.text, body.plain.raw],
 8          strings.icontains(., 'Scanned by Gmail')
 9          and regex.icontains(., '[KM]b\b')
10  )
11  
12  // negate highly trusted sender domains unless they fail DMARC authentication
13  and (
14    (
15      sender.email.domain.root_domain in $high_trust_sender_root_domains
16      and not headers.auth_summary.dmarc.pass
17    )
18    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
19  )
20  // if the sender has been marked as malicious, but has FPs, don't alert
21  and (
22    (
23      profile.by_sender().any_messages_malicious_or_spam
24      and not profile.by_sender().any_false_positives
25    )
26    or not profile.by_sender().any_messages_malicious_or_spam
27  )  
28attack_types:
29  - "Credential Phishing"
30tactics_and_techniques:
31  - "Impersonation: Brand"
32detection_methods:
33  - "Content analysis"
34  - "File analysis"
35  - "Sender analysis"
36id: "0f5a4e14-3a9a-5354-a5d7-faa1268dd4d4"