Attachment: Microsoft 365 credential phishing

  1name: "Attachment: Microsoft 365 credential phishing"
  2description: |
  3    Looks for messages with an image attachment that contains words related to Microsoft, Office365, and passwords.
  4type: "rule"
  5severity: "high"
  6source: |
  7  type.inbound
  8  and length(filter(attachments, .file_type not in $file_types_images)) == 0
  9  and (
 10    any(attachments,
 11        .file_type in $file_types_images
 12        and any(ml.logo_detect(.).brands, strings.starts_with(.name, "Microsoft"))
 13    )
 14    or any(attachments,
 15           .file_type in $file_types_images
 16           and any(file.explode(.),
 17                   strings.ilike(.scan.ocr.raw, "*microsoft*", "*office")
 18                   and length(.scan.ocr.raw) < 1500
 19           )
 20    )
 21  )
 22  and any(attachments,
 23          .file_type in $file_types_images
 24          and any(file.explode(.),
 25                  length(filter([
 26                                  "password",
 27                                  "unread messages",
 28                                  "Shared Documents",
 29                                  "expiration",
 30                                  "expire",
 31                                  "expiring",
 32                                  "kindly",
 33                                  "renew",
 34                                  "review",
 35                                  "emails failed",
 36                                  "kicked out",
 37                                  "prevented",
 38                                  "storage",
 39                                  "required now",
 40                                  "cache",
 41                                  "qr code",
 42                                  "security update",
 43                                  "invoice",
 44                                  "retrieve",
 45                                  "blocked"
 46                                ],
 47                                strings.icontains(..scan.ocr.raw, .)
 48                         )
 49                  ) >= 2
 50                  or (
 51                    any(ml.nlu_classifier(.scan.ocr.raw).intents,
 52                        .name == "cred_theft" and .confidence == "high"
 53                    )
 54                    and length(ml.nlu_classifier(.scan.ocr.raw).entities) > 1
 55                  )
 56          )
 57  )
 58  and (
 59    not sender.email.domain.domain in ("microsoft.com", "sharepointonline.com")
 60    or not any(headers.hops,
 61               .authentication_results.compauth.verdict is not null
 62               and .authentication_results.compauth.verdict == "pass"
 63    )
 64  )
 65  
 66  // negate angelbeat urls and microsoft disclaimer links
 67  and (
 68    length(body.links) > 0
 69    and not all(body.links,
 70                .href_url.domain.root_domain in (
 71                  "abeatinfo.com",
 72                  "abeatinvite.com",
 73                  "aka.ms",
 74                  "angelbeat.com"
 75                )
 76    )
 77  )
 78  
 79  // negate replies
 80  and (
 81    (
 82      (length(headers.references) > 0 or headers.in_reply_to is null)
 83      and not (
 84        (
 85          strings.istarts_with(subject.subject, "RE:")
 86          or strings.istarts_with(subject.subject, "R:")
 87          or strings.istarts_with(subject.subject, "ODG:")
 88          or strings.istarts_with(subject.subject, "答复:")
 89          or strings.istarts_with(subject.subject, "AW:")
 90          or strings.istarts_with(subject.subject, "TR:")
 91          or strings.istarts_with(subject.subject, "FWD:")
 92          or regex.icontains(subject.subject,
 93                             '^(\[[^\]]+\]\s?){0,3}(re|fwd?)\s?:'
 94          )
 95        )
 96      )
 97    )
 98    or length(headers.references) == 0
 99  )
100  and (
101    not profile.by_sender().solicited
102    or (
103      profile.by_sender().any_messages_malicious_or_spam
104      and not profile.by_sender().any_messages_benign
105    )
106  )
107  
108  // negate highly trusted sender domains unless they fail DMARC authentication
109  and (
110    (
111      sender.email.domain.root_domain in $high_trust_sender_root_domains
112      and not headers.auth_summary.dmarc.pass
113    )
114    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
115  )
116  and not profile.by_sender().any_messages_benign  
117attack_types:
118  - "Credential Phishing"
119tactics_and_techniques:
120  - "Impersonation: Brand"
121  - "Social engineering"
122detection_methods:
123  - "Content analysis"
124  - "File analysis"
125  - "Header analysis"
126  - "Optical Character Recognition"
127  - "Sender analysis"
128id: "edce0229-5e8f-5359-a5c8-36570840049f"