Attachment: Legal themed message or PDF with suspicious indicators

  1name: "Attachment: Legal themed message or PDF with suspicious indicators"
  2description: "Detects messages with short body content or emoji containing PDF attachments from suspicious creators that include legal and compliance language with embedded malicious links, URL shorteners, or newly registered domains."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  // short body or contains emoji
  8  and (
  9    length(body.current_thread.text) < 1500
 10    or regex.contains(body.plain.raw,
 11                      '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
 12    )
 13    or regex.contains(subject.base,
 14                      '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
 15    )
 16  )
 17  
 18  // is not a reply
 19  and length(headers.references) == 0
 20  and headers.in_reply_to is null
 21  and (
 22    ( // only one attachment
 23      length(attachments) == 1
 24      // or, any 2 attachments share the ~same file name
 25      or any(attachments,
 26             any(regex.extract(.file_name,
 27                               // the regex extracts the file name, discarding the file extention and any numbers in parens
 28                               // "test.txt" and "test (1).pdf" become "test"
 29                               '(?P<file_name>.*?)(?:\s*\([^)]+\))*\.[^.]+$'
 30                 ),
 31                 length(filter(attachments,
 32                               strings.istarts_with(.file_name,
 33                                                    ..named_groups["file_name"]
 34                               )
 35                        )
 36                 ) > 1
 37             )
 38      )
 39    )
 40    // suspicious creator
 41    and any(attachments,
 42            (.file_extension == "pdf" or .file_type == "pdf")
 43            and any(file.explode(.),
 44                    strings.ilike(.scan.exiftool.producer,
 45                                  "*Google Docs Renderer*",
 46                                  "*Skia/PDF*",
 47                                  "*Neevia Document Converter*"
 48                    )
 49            )
 50    )
 51  )
 52  and (
 53    // legal language in body with suspicious link in attachment
 54    (
 55      any(ml.nlu_classifier(body.current_thread.text).topics,
 56          .name == "Legal and Compliance" and .confidence in ("medium", "high")
 57      )
 58      and any(attachments,
 59              (.file_extension == "pdf" or .file_type == "pdf")
 60              and any(file.explode(.),
 61                      0 < length(.scan.pdf.urls) < 5
 62                      and (
 63                        any(.scan.pdf.urls,
 64                            // with links that are URL shortners
 65                            .domain.root_domain in $url_shorteners
 66                            or .domain.domain in $url_shorteners
 67                            or network.whois(.domain).days_old < 14
 68                            // when visiting those links, the link it is sus
 69                            or ml.link_analysis(.).effective_url.domain.tld in $suspicious_tlds
 70                            or ml.link_analysis(.).credphish.contains_captcha
 71                            or ml.link_analysis(.).credphish.disposition == "phishing"
 72                            or strings.icontains(ml.link_analysis(.).final_dom.display_text,
 73                                                 "I'm Human"
 74                            )
 75                        )
 76                      )
 77              )
 78      )
 79    )
 80    // no body text, legal language in attachment
 81    or (
 82      length(body.current_thread.text) < 50
 83      and any(attachments,
 84              (.file_extension == "pdf" or .file_type == "pdf")
 85              and any(file.explode(.),
 86                      (
 87                        length(ml.nlu_classifier(.scan.ocr.raw).topics) == 1
 88                        and any(ml.nlu_classifier(.scan.ocr.raw).topics,
 89                                .name == "Legal and Compliance"
 90                                and .confidence in ("medium", "high")
 91                        )
 92                        and not any(ml.nlu_classifier(.scan.ocr.raw).entities,
 93                                    .name == "sender"
 94                                    and .text =~ sender.display_name
 95                        )
 96                      )
 97                      // foreign language indicators
 98                      or regex.icontains(.scan.ocr.raw,
 99                                         'pornograph(y|ie)',
100                                         'interpol',
101                                         'europol',
102                                         'dissuade',
103                                         // French indicators, seen in threatening language
104                                         'ce jeu en ligne',
105                                         'vraie vie'
106                      )
107              )
108      )
109    )
110  )  
111attack_types:
112  - "Credential Phishing"
113  - "Extortion"
114  - "BEC/Fraud"
115tactics_and_techniques:
116  - "Evasion"
117  - "PDF"
118  - "Social engineering"
119detection_methods:
120  - "Content analysis"
121  - "File analysis"
122  - "Natural Language Understanding"
123  - "Optical Character Recognition"
124  - "URL analysis"
125  - "Whois"
126  - "Header analysis"
127  - "Exif analysis"
128id: "19133301-8bc0-5a91-b044-fb72cba16bbe"