Attachment: Office file with document sharing and browser instruction lures

 1name: "Attachment: Office file with document sharing and browser instruction lures"
 2description: "Detects macro-enabled attachments containing document sharing language (sent, shared, forwarded) combined with browser interaction instructions (copy, right-click) or common email disclaimers. These tactics are often used to trick users into enabling macros or following malicious instructions."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(filter(attachments,
 8                 .file_extension in $file_extensions_macros
 9                 // limit the size to reduce FPs, the larger the document, the more likely it is for FPs on benign automated reports
10                 and .size < 2000000
11          ),
12          // Detection Note: There are multiple regex patterns used in multiple places, it'll be important to keep them in sync
13          any(file.explode(.),
14              // document sharing lure
15              any(.scan.strings.strings,
16                  regex.icontains(.,
17                                  '(?:sent|shared|forwarded|provided|invited)(?:\s+\w+){0,9}\s+(?:document|file|attachment)',
18                  )
19              )
20              // ocr output
21              or regex.icontains(.scan.ocr.raw,
22                                 '(?:sent|shared|forwarded|provided|invited)(?:\s+\w+){0,9}\s+(?:document|file|attachment)',
23              )
24          )
25          // copy/paste browser stuff
26          and (
27            any(file.explode(.),
28                any(.scan.strings.strings,
29                    regex.icontains(.,
30                                    '(?:copy (?:and paste)?|right.?click)(?:\s+\w+\s*){0,9}browser'
31                    )
32                // ocr output
33                )
34                or regex.icontains(.scan.ocr.raw,
35                                   '(?:copy (?:and paste)?|right.?click)(?:\s+\w+\s*){0,9}browser'
36                )
37                or 5 of (
38                  strings.icontains(.scan.ocr.raw,
39                                    'confidential and intended solely'
40                  ),
41                  strings.icontains(.scan.ocr.raw,
42                                    'intended solely for the use of'
43                  ),
44                  strings.icontains(.scan.ocr.raw, 'intended recipient'),
45                  strings.icontains(.scan.ocr.raw, 'received this email in error'),
46                  strings.icontains(.scan.ocr.raw,
47                                    'notify the sender immediately'
48                  ),
49                  strings.icontains(.scan.ocr.raw, 'delete it from your system'),
50                  strings.icontains(.scan.ocr.raw, 'delete the email from'),
51                  strings.icontains(.scan.ocr.raw, 'virus-free'),
52                  strings.icontains(.scan.ocr.raw, 'scan for viruses'),
53                  strings.icontains(.scan.ocr.raw, 'legally binding agreement'),
54                  strings.icontains(.scan.ocr.raw, 'informational purposes only'),
55                  strings.icontains(.scan.ocr.raw,
56                                    'any attachments are confidential'
57                  ),
58                  strings.icontains(.scan.ocr.raw, 'loss or damage arising'),
59                  strings.icontains(.scan.ocr.raw, 'responsibility for any loss'),
60                  strings.icontains(.scan.ocr.raw, 'unauthorised and prohibited'),
61                  strings.icontains(.scan.ocr.raw, 'subject to legal privilege'),
62                  strings.icontains(.scan.ocr.raw,
63                                    'The information contained in or attached'
64                  ),
65                  strings.icontains(.scan.ocr.raw,
66                                    'people to whom it is addressed'
67                  )
68                )
69            )
70          )
71  )  
72attack_types:
73  - "Credential Phishing"
74tactics_and_techniques:
75  - "Social engineering"
76  - "Evasion"
77detection_methods:
78  - "Archive analysis"
79  - "File analysis"
80  - "Macro analysis"
81  - "Optical Character Recognition"
82  - "Content analysis"
83id: "b1250a4b-fd4d-5c52-af60-83800eedac10"