Attachment: Word document with hyperlink and fraud language

 1name: "Attachment: Word document with hyperlink and fraud language"
 2description: "Detects inbound messages sent from free email providers with an empty subject line and body that carry a Word document (doc/docx) attachment. The attachment is inspected for embedded HYPERLINK field codes containing valid URLs, and its extracted text is passed through an NLU classifier to identify credential theft or advance fee fraud intent, indicating a socially engineered attack hidden inside the document."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and sender.email.domain.root_domain in $free_email_providers
 8  and not (subject.is_reply or subject.is_forward)
 9  and subject.base == ''
10  and body.current_thread.text == ''
11  and any(filter(attachments, .file_type in~ ("docx", "doc")),
12          any(file.explode(.),
13              any(html.xpath(strings.parse_html(.scan.strings.raw),
14                             "//*[contains(text(),'HYPERLINK')]"
15                  ).nodes,
16                  any(regex.extract(.raw, 'https?://[^"''<>&\s]+'),
17                      strings.parse_url(.full_match).domain.valid
18                  )
19              )
20          )
21          and any(file.explode(.),
22                  .file_name == "text"
23                  and any(ml.nlu_classifier(.scan.strings.raw).intents,
24                          .name in ("cred_theft", "advance_fee")
25                          and .confidence != 'low'
26                  )
27          )
28  )  
29attack_types:
30  - "Credential Phishing"
31  - "BEC/Fraud"
32tactics_and_techniques:
33  - "Free email provider"
34  - "Social engineering"
35  - "Evasion"
36detection_methods:
37  - "File analysis"
38  - "XML analysis"
39  - "HTML analysis"
40  - "URL analysis"
41  - "Natural Language Understanding"
42  - "Sender analysis"
43id: "6dabe75d-5631-5d53-b215-4d45bf1c381f"