Body: Tox messenger ID

 1name: "Body: Tox messenger ID"
 2description: "Detects messages containing a Tox messenger ID. This tactic is commonly used by extortionists and ransomware operators to move communication outside of email to an anonymous, untraceable channel."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and regex.icontains(body.current_thread.text, '\bq?tox\b')
 8  and regex.contains(body.current_thread.text, '\b[0-9a-fA-F]{76}\b')
 9  // negate intel feeds
10  and not (
11    sender.email.domain.root_domain in (
12      "crowdstrike.com",
13      "intel471.com",
14      "recordedfuture.com"
15    )
16    and coalesce(headers.auth_summary.dmarc.pass, false)
17  )  
18tags:
19 - "Attack surface reduction"
20attack_types:
21  - "Extortion"
22  - "Malware/Ransomware"
23tactics_and_techniques:
24  - "Social engineering"
25  - "Out of band pivot"
26  - "Evasion"
27detection_methods:
28  - "Content analysis"
29id: "74f99183-6634-5a5f-95ad-123497cb5f7e"