Attachment: HTML smuggling - QR Code with suspicious links

 1name: "Attachment: HTML smuggling - QR Code with suspicious links"
 2description: "This rule detects messages with HTML attachments containing QR codes"
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and 1 <= length(attachments) < 3
 8  
 9  // inspects HTML attachments for QR codes
10  and any(attachments,
11          (
12            .file_extension in~ ("html", "htm", "shtml", "dhtml", "xhtml")
13            or (
14              .file_extension is null
15              and .file_type == "unknown"
16              and .content_type == "application/octet-stream"
17            )
18            or .file_extension in~ $file_extensions_common_archives
19            or .file_type == "html"
20            or .content_type == "text/html"
21          )
22          and any(file.explode(file.html_screenshot(.)),
23                  // any URL
24                  ml.link_analysis(.scan.qr.url).submitted
25                  // currently we won't pick it up as a URL if it's
26                  // not prefaced with a scheme. this is not very strong,
27                  // but it's unlikely to cause FPs for this rule
28                  or regex.contains(.scan.qr.data, '\.')
29          )
30  )
31  
32  // negate highly trusted sender domains unless they fail DMARC authentication
33  and not (
34    sender.email.domain.root_domain in $high_trust_sender_root_domains
35    and coalesce(headers.auth_summary.dmarc.pass, false)
36  )
37  and (
38    not profile.by_sender().solicited
39    or (
40      profile.by_sender().any_messages_malicious_or_spam
41      and not profile.by_sender().any_messages_benign
42    )
43  )
44  and not profile.by_sender().any_messages_benign  
45attack_types:
46  - "Credential Phishing"
47tactics_and_techniques:
48  - "QR code"
49detection_methods:
50  - "Computer Vision"
51  - "Header analysis"
52  - "Natural Language Understanding"
53  - "QR code analysis"
54  - "Sender analysis"
55  - "URL analysis"
56  - "URL screenshot"
57id: "010e757d-f569-5f25-b68b-832edb5e1120"