Attachment: Office file with document sharing and browser instruction lures
Detects macro-enabled attachments containing document sharing language (sent, shared, forwarded) combined with browser interaction instructions (copy, right-click) or common email disclaimers. These tactics are often used to trick users into enabling macros or following malicious instructions.
Sublime rule (View on GitHub)
1name: "Attachment: Office file with document sharing and browser instruction lures"
2description: "Detects macro-enabled attachments containing document sharing language (sent, shared, forwarded) combined with browser interaction instructions (copy, right-click) or common email disclaimers. These tactics are often used to trick users into enabling macros or following malicious instructions."
3type: "rule"
4severity: "high"
5source: |
6 type.inbound
7 and any(filter(attachments,
8 .file_extension in $file_extensions_macros
9 // limit the size to reduce FPs, the larger the document, the more likely it is for FPs on benign automated reports
10 and .size < 2000000
11 ),
12 // Detection Note: There are multiple regex patterns used in multiple places, it'll be important to keep them in sync
13 any(file.explode(.),
14 // document sharing lure
15 (
16 length(.scan.strings.raw, ) < 1000
17 and regex.icontains(.scan.strings.raw,
18 '(?:sent|shared|forwarded|provided|invited|received)(?:\s+\w+){0,9}\s+(?:document|file|attachment)',
19 )
20 )
21
22 // ocr output
23 or (
24 length(.scan.ocr.raw) < 1000
25 and regex.icontains(.scan.ocr.raw,
26 '(?:sent|shared|forwarded|provided|invited|received)(?:\s+\w+){0,9}\s+(?:document|file|attachment)',
27 )
28 )
29 or (
30 length(.scan.ocr.raw) < 500
31 and strings.ends_with(.scan.ocr.raw, 'REVIEW DOCUMENTS')
32 )
33 )
34 // copy/paste stuff or disclaimer text in the OCR output
35 and (
36 any(file.explode(.),
37 (
38 length(.scan.strings.raw, ) < 1000
39 and (
40 regex.icontains(.scan.strings.raw,
41 '(?:copy (?:and paste)?|right.?click)(?:\s+\w+\s*){0,9}browser',
42 'click.{0,50}(?:above|below|button) to (?:access|open)'
43 )
44 )
45 )
46
47 // ocr output
48 or (
49 length(.scan.ocr.raw) < 1000
50 and (
51 regex.icontains(.scan.ocr.raw,
52 '(?:copy (?:and paste)?|right.?click)(?:\s+\w+\s*){0,9}browser',
53 'click.{0,50}(?:above|below|button) to (?:access|open)'
54 )
55 )
56 )
57 or 5 of (
58 strings.icontains(.scan.ocr.raw,
59 'confidential and intended solely'
60 ),
61 strings.icontains(.scan.ocr.raw,
62 'intended solely for the use of'
63 ),
64 strings.icontains(.scan.ocr.raw, 'intended only for the people'),
65 strings.icontains(.scan.ocr.raw, 'intended recipient'),
66 strings.icontains(.scan.ocr.raw, 'received this email in error'),
67 strings.icontains(.scan.ocr.raw,
68 'notify the sender immediately'
69 ),
70 strings.icontains(.scan.ocr.raw, 'delete it from your system'),
71 strings.icontains(.scan.ocr.raw, 'delete the email from'),
72 strings.icontains(.scan.ocr.raw, 'virus-free'),
73 strings.icontains(.scan.ocr.raw, 'scan for viruses'),
74 strings.icontains(.scan.ocr.raw, 'legally binding agreement'),
75 strings.icontains(.scan.ocr.raw, 'informational purposes only'),
76 strings.icontains(.scan.ocr.raw,
77 'any attachments are confidential'
78 ),
79 strings.icontains(.scan.ocr.raw, 'loss or damage arising'),
80 strings.icontains(.scan.ocr.raw, 'responsibility for any loss'),
81 strings.icontains(.scan.ocr.raw, 'unauthorised and prohibited'),
82 strings.icontains(.scan.ocr.raw, 'subject to legal privilege'),
83 strings.icontains(.scan.ocr.raw,
84 'The information contained in or attached'
85 ),
86 strings.icontains(.scan.ocr.raw,
87 'The information contained in this email'
88 ),
89 strings.icontains(.scan.ocr.raw,
90 'people to whom it is addressed'
91 ),
92 strings.icontains(.scan.ocr.raw,
93 'received this in error, please inform'
94 ),
95 strings.icontains(.scan.ocr.raw, 'inform the sender and/or'),
96 strings.icontains(.scan.ocr.raw,
97 'immediately and delete the material'
98 ),
99 strings.icontains(.scan.ocr.raw,
100 'then delete the email from your inbox'
101 ),
102 strings.icontains(.scan.ocr.raw,
103 'confidential and/or privileged material'
104 ),
105 strings.icontains(.scan.ocr.raw,
106 'confidential and / or legally privileged'
107 ),
108 strings.icontains(.scan.ocr.raw,
109 'The information transmitted is intended'
110 ),
111 strings.icontains(.scan.ocr.raw,
112 'other than the intended recipient is prohibited'
113 ),
114 strings.icontains(.scan.ocr.raw,
115 'intended for use by the addressee'
116 ),
117 strings.icontains(.scan.ocr.raw,
118 'taking of any action in reliance upon'
119 ),
120 strings.icontains(.scan.ocr.raw,
121 'distribution is strictly prohibited'
122 ),
123 strings.icontains(.scan.ocr.raw,
124 'communication from the sender is confidential'
125 ),
126 strings.icontains(.scan.ocr.raw, 'use by the recipient'),
127 strings.icontains(.scan.ocr.raw,
128 'and others authorized to receive it'
129 ),
130 strings.icontains(.scan.ocr.raw, 'you are hereby notified'),
131 strings.icontains(.scan.ocr.raw,
132 'action in relation of the contents of this information'
133 ),
134 strings.icontains(.scan.ocr.raw,
135 'The information contained in this'
136 ),
137 strings.icontains(.scan.ocr.raw, 'you are not the recipient'),
138 strings.icontains(.scan.ocr.raw, 'may be unlawful'),
139 )
140 )
141 )
142 )
143attack_types:
144 - "Credential Phishing"
145tactics_and_techniques:
146 - "Social engineering"
147 - "Evasion"
148detection_methods:
149 - "Archive analysis"
150 - "File analysis"
151 - "Macro analysis"
152 - "Optical Character Recognition"
153 - "Content analysis"
154id: "b1250a4b-fd4d-5c52-af60-83800eedac10"