Attachment: Mobileconfig profile with mismatched embedded email

 1name: "Attachment: Mobileconfig profile with mismatched embedded email"
 2description: "Detects inbound messages with a mobileconfig attachment containing an embedded email address whose domain differs from the sender's domain and does not match any known sender or recipient address. These crafted files are used as a lure to trick recipients into installing a bogus update, often paired with payment or account-themed subject lines and disposable or spoofed sender domains."
 3type: "rule"
 4severity: "medium"
 5source: |
 6    type.inbound
 7    and any(attachments,
 8            .file_extension == "mobileconfig"
 9            and any(regex.iextract(file.parse_text(.).text,
10                                   '<string>\s*(?P<email>[^\s]+@[^\s]+)\s*[^\<]+\</string>'
11                    ),
12                    strings.parse_email(.named_groups["email"]).domain.root_domain != sender.email.domain.root_domain
13                    and strings.parse_email(.named_groups["email"]).email not in map(recipients.to,
14                                                                                     .email.email
15                    )
16                    and strings.parse_email(.named_groups["email"]).email not in $recipient_emails
17                    and strings.parse_email(.named_groups["email"]).email not in $sender_emails
18            )
19    )    
20attack_types:
21  - "Credential Phishing"
22tactics_and_techniques:
23  - "Evasion"
24  - "Social engineering"
25detection_methods:
26  - "File analysis"
27  - "Content analysis"
28  - "Sender analysis"
29id: "6a2c49ee-1106-5edd-ba77-1e88b17278e0"