Social engineering: Remote access tool install instructions disguised as document share

 1name: "Social engineering: Remote access tool install instructions disguised as document share"
 2description: "Detects messages that reference a remote access tool (e.g., Zoho Assist, AnyDesk, ScreenConnect, TeamViewer, Splashtop) alongside step-by-step installation guidance, framed as a shared document or report notification. This pattern is commonly used to socially engineer recipients into installing remote access software under false pretenses."
 3type: "rule"
 4severity: "high"
 5source: |
 6  (type.inbound or type.internal)
 7  // remote access tool named in the body
 8  and regex.icontains(body.current_thread.text,
 9                      '(?:zoho assist|anydesk|screenconnect|teamviewer|splashtop|remote (?:support|access))'
10  )
11  // with step-by-step install instructions
12  and regex.icontains(body.current_thread.text,
13                      'allow the installation',
14                      'installation to finish',
15                      'select .{0,3}(?:yes|allow)'
16  )
17  // and the template's framing
18  and (
19    strings.icontains(body.current_thread.text, 'important viewing note')
20    or regex.icontains(body.current_thread.text,
21                       'has shared (?:a|an|the) [^.]{0,80}?(?:report|statement|document)'
22    )
23  )  
24attack_types:
25  - "Malware/Ransomware"
26tactics_and_techniques:
27  - "Social engineering"
28detection_methods:
29  - "Content analysis"
30id: "55912c58-3e02-5b38-8fee-fcbf8621bdc1"