Body: HTML whitespace stuffing with short initial message

 1name: "Body: HTML whitespace stuffing with short initial message"
 2description: "Detects messages that uses HTML-based whitespace padding (repeated br tags, p-nbsp blocks, or div-br wrappers) to push content below the visible fold."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // not a legitimate thread reply or is indicative of self sender or has an invalid reply to
 8  and (
 9    (length(headers.references) == 0 and headers.in_reply_to is null)
10    or (
11      length(recipients.to) == 1
12      and length(recipients.cc) == 0
13      and (
14        sender.email.email == recipients.to[0].email.email
15        or headers.reply_to[0].email.domain.valid == false
16      )
17    )
18  )
19  // whitespace-stuffed credphish targets single recipients
20  and length(recipients.to) == 1
21  and length(recipients.cc) == 0
22  and length(recipients.bcc) == 0
23  // short lure
24  and length(body.current_thread.text) < 2000
25  // HTML whitespace stuffing
26  and (
27    regex.icontains(body.html.raw,
28                    '(?:</?br\s*/?\s*>\s*){30,}',
29                    '(?:<p>\s*(?:&nbsp;|&#160;)\s*</p>\s*){10,}',
30                    '(?:<div[^>]*>\s*<br\s*/?\s*>\s*</div>\s*){20,}'
31    )
32    or (
33      regex.icontains(body.html.raw,
34                      '(?:<p[^>]*>\s*<o:p>\s*(?:&nbsp;|&#160;)\s*</o:p>\s*</p>\s*){10,}',
35                      '(?:<p[^>]*>\s*(?:&nbsp;|&#160;)\s*</p>\s*){30,}'
36      )
37      and (
38        any(ml.nlu_classifier(body.current_thread.text).intents,
39            .name in ("cred_theft", "bec")
40        )
41        or any(body.current_thread.links,
42               strings.ends_with(.href_url.path, 'php')
43        )
44      )
45    )
46  )
47  // low word count excludes legitimate long threads
48  and regex.count(body.html.display_text, '\S+') < 3000
49  
50  // visible link in current thread pointing to external domain
51  and any(body.current_thread.links,
52          .href_url.domain.root_domain != sender.email.domain.root_domain
53          and .href_url.domain.valid
54          and .href_url.scheme in ("https", "http")
55          and .visible == true
56  )
57  
58  // credential phishing has few visible links - newsletters have many
59  and length(filter(body.current_thread.links,
60                    .href_url.domain.valid
61                    and .href_url.scheme in ("https", "http")
62                    and .visible == true
63             )
64  ) < 10
65  
66  // negate high trust senders that pass auth
67  and not (
68    sender.email.domain.root_domain in $high_trust_sender_root_domains
69    and coalesce(headers.auth_summary.dmarc.pass, false)
70  )
71  
72  // negate authenticated senders with unsubscribe mechanism (marketing)
73  and not (
74    coalesce(headers.auth_summary.dmarc.pass, false)
75    and any(body.current_thread.links,
76            strings.icontains(.display_text, "unsubscribe")
77            or strings.icontains(.href_url.path, "unsubscribe")
78    )
79  )  
80tags:
81 - "Attack surface reduction"
82attack_types:
83  - "Credential Phishing"
84tactics_and_techniques:
85  - "Evasion"
86  - "Social engineering"
87detection_methods:
88  - "Content analysis"
89  - "HTML analysis"
90  - "Header analysis"
91id: "f8a3c1d2-7e4b-4a9f-b6c8-2d1e5f3a7b9c"