Attachment with high risk VBA macro (unsolicited)

 1name: "Attachment with high risk VBA macro (unsolicited)"
 2description: |
 3    Potentially malicious attachment containing a VBA macro. Oletools categorizes the macro risk as 'high'.
 4references:
 5  - "https://threatpost.com/microsoft-outlook-users-targeted-by-gamaredons-new-vba-macro/156484/"
 6type: "rule"
 7severity: "high"
 8source: |
 9  type.inbound
10  and any(attachments,
11          .file_extension in~ $file_extensions_macros
12          and file.oletools(.).indicators.vba_macros.risk == "high"
13  )
14  and (
15    (
16      sender.email.domain.root_domain in $free_email_providers
17      and sender.email.email not in $recipient_emails
18    )
19    or (
20      sender.email.domain.root_domain not in $free_email_providers
21      and sender.email.domain.domain not in $recipient_domains
22    )
23  )  
24attack_types:
25  - "Malware/Ransomware"
26tactics_and_techniques:
27  - "Macros"
28detection_methods:
29  - "File analysis"
30  - "Macro analysis"
31  - "OLE analysis"
32  - "Sender analysis"
33id: "a2b20e16-b363-50f1-92a5-ee6c41012118"