Attachment: Legal themed message or PDF with suspicious indicators

  1name: "Attachment: Legal themed message or PDF with suspicious indicators"
  2description: "Detects messages with short body content or emoji containing PDF attachments from suspicious creators that include legal and compliance language with embedded malicious links, URL shorteners, or newly registered domains."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  // short body or contains emoji
  8  and (
  9    length(body.current_thread.text) < 1500
 10    or regex.contains(body.plain.raw,
 11                      '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
 12    )
 13    or regex.contains(subject.base,
 14                      '[\x{1F300}-\x{1F5FF}\x{1F600}-\x{1F64F}\x{1F680}-\x{1F6FF}\x{1F700}-\x{1F77F}\x{1F780}-\x{1F7FF}\x{1F900}-\x{1F9FF}\x{2600}-\x{26FF}\x{2700}-\x{27BF}\x{2300}-\x{23FF}]'
 15    )
 16  )
 17  
 18  // is not a reply
 19  and length(headers.references) == 0
 20  and headers.in_reply_to is null
 21  and (
 22    ( // only one attachment
 23      length(attachments) == 1
 24      // or, any 2 attachments share the ~same file name
 25      or any(attachments,
 26             any(regex.extract(.file_name,
 27                               // the regex extracts the file name, discarding the file extention and any numbers in parens
 28                               // "test.txt" and "test (1).pdf" become "test"
 29                               '(?P<file_name>.*?)(?:\s*\([^)]+\))*\.[^.]+$'
 30                 ),
 31                 length(filter(attachments,
 32                               strings.istarts_with(.file_name,
 33                                                    ..named_groups["file_name"]
 34                               )
 35                        )
 36                 ) > 1
 37             )
 38      )
 39    )
 40    // suspicious creator
 41    and any(attachments,
 42            (.file_extension == "pdf" or .file_type == "pdf")
 43            and any(file.explode(.),
 44                    // .producer
 45                    strings.ilike(.scan.exiftool.producer,
 46                                  "*Google Docs Renderer*",
 47                                  "*Skia/PDF*",
 48                                  "*Neevia Document Converter*"
 49                    )
 50                    // producer does not contain any words
 51                    or regex.imatch(.scan.exiftool.producer, "^[^a-zA-Z]+$")
 52                    // .creator
 53                    or strings.istarts_with(.scan.exiftool.creator, "wkhtmltopdf")
 54            )
 55    )
 56  )
 57  and (
 58    // legal language in body with suspicious link in attachment
 59    (
 60      any(ml.nlu_classifier(body.current_thread.text).topics,
 61          .name == "Legal and Compliance" and .confidence in ("medium", "high")
 62      )
 63      and any(attachments,
 64              (.file_extension == "pdf" or .file_type == "pdf")
 65              and any(file.explode(.),
 66                      0 < length(.scan.pdf.urls) < 5
 67                      and (
 68                        any(.scan.pdf.urls,
 69                            // with links that are URL shortners
 70                            .domain.root_domain in $url_shorteners
 71                            or .domain.domain in $url_shorteners
 72                            or network.whois(.domain).days_old < 14
 73                            // when visiting those links, the link it is sus
 74                            or ml.link_analysis(.).effective_url.domain.tld in $suspicious_tlds
 75                            or ml.link_analysis(.).credphish.contains_captcha
 76                            or ml.link_analysis(.).credphish.disposition == "phishing"
 77                            or strings.icontains(ml.link_analysis(.).final_dom.display_text,
 78                                                 "I'm Human",
 79                                                 "security check"
 80                            )
 81                        )
 82                      )
 83              )
 84      )
 85    )
 86    // no body text, legal language in attachment
 87    or (
 88      length(body.current_thread.text) < 50
 89      and any(attachments,
 90              (.file_extension == "pdf" or .file_type == "pdf")
 91              and any(file.explode(.),
 92                      (
 93                        length(ml.nlu_classifier(.scan.ocr.raw).topics) == 1
 94                        and any(ml.nlu_classifier(.scan.ocr.raw).topics,
 95                                .name == "Legal and Compliance"
 96                                and .confidence in ("medium", "high")
 97                        )
 98                        and not any(ml.nlu_classifier(.scan.ocr.raw).entities,
 99                                    .name == "sender"
100                                    and .text =~ sender.display_name
101                        )
102                      )
103                      // foreign language indicators
104                      or regex.icontains(.scan.ocr.raw,
105                                         'pornograph(y|ie)',
106                                         'interpol\b',
107                                         'europol',
108                                         'dissuade',
109                                         // French indicators, seen in threatening language
110                                         'ce jeu en ligne',
111                                         'vraie vie'
112                      )
113              )
114      )
115    )
116  )  
117
118attack_types:
119  - "Credential Phishing"
120  - "Extortion"
121  - "BEC/Fraud"
122tactics_and_techniques:
123  - "Evasion"
124  - "PDF"
125  - "Social engineering"
126detection_methods:
127  - "Content analysis"
128  - "File analysis"
129  - "Natural Language Understanding"
130  - "Optical Character Recognition"
131  - "URL analysis"
132  - "Whois"
133  - "Header analysis"
134  - "Exif analysis"
135id: "19133301-8bc0-5a91-b044-fb72cba16bbe"