Attachment: GZ archive with credential theft content

 1name: "Attachment: GZ archive with credential theft content"
 2description: "Detects inbound messages containing a .gz attachment that, when exploded, contains an email or HTML file. The rule then inspects the inner content for credential theft intent—either by parsing a well-formed embedded EML and running NLU classification on the message body, or, if the EML is malformed, by extracting HTML content, pulling href links, and running link analysis plus NLU classification on the resulting page text to identify high-confidence credential theft indicators."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(filter(attachments, .file_type == "gz"),
 8          // archive contains an email or an html payload
 9          any(file.explode(.),
10              any(.flavors.yara, . in ("email_file", "html_file"))
11          )
12          and (
13            // well-formed inner eml, NLU on parsed body
14            any(file.expand_archives(.).files,
15                any(ml.nlu_classifier(file.parse_eml(.).body.current_thread.text).intents,
16                    .name == "cred_theft" and .confidence == "high"
17                )
18            )
19            // malformed inner eml, byte-scan html + link_analysis
20            or any(filter(file.explode(.), any(.flavors.yara, . == "html_file")),
21                   any(html.xpath(strings.parse_html(.scan.strings.raw),
22                                  '//a/@href'
23                       ).nodes,
24                       any(ml.nlu_classifier(ml.link_analysis(strings.parse_url(.raw
25                                                              )
26                                             ).final_dom.inner_text
27                           ).intents,
28                           .name == "cred_theft" and .confidence == "high"
29                       )
30                   )
31            )
32          )
33  )  
34tags:
35  - "Attack surface reduction"
36attack_types:
37  - "Credential Phishing"
38tactics_and_techniques:
39  - "Evasion"
40detection_methods:
41  - "Archive analysis"
42  - "File analysis"
43  - "YARA"
44  - "Natural Language Understanding"
45  - "HTML analysis"
46  - "URL analysis"
47id: "12d6194a-aeb6-5e92-8559-17464a47d0ea"