Body: HTML whitespace stuffing with short initial message

 1name: "Body: HTML whitespace stuffing with short initial message"
 2description: "Detects messages that uses HTML-based whitespace padding (repeated br tags, p-nbsp blocks, or div-br wrappers) to push content below the visible fold."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // not a legitimate thread reply or is indicative of self sender
 8  and (
 9    (length(headers.references) == 0 and headers.in_reply_to is null)
10    or (
11      length(recipients.to) == 1
12      and length(recipients.cc) == 0
13      and sender.email.email == recipients.to[0].email.email
14    )
15  )
16  // whitespace-stuffed credphish targets single recipients
17  and length(recipients.to) == 1
18  and length(recipients.cc) == 0
19  and length(recipients.bcc) == 0
20  // short lure
21  and length(body.current_thread.text) < 2000
22  // HTML whitespace stuffing
23  and (
24    regex.icontains(body.html.raw,
25                    '(?:<br\s*/?\s*>\s*){30,}',
26                    '(?:<p>\s*(?:&nbsp;|&#160;)\s*</p>\s*){10,}',
27                    '(?:<div[^>]*>\s*<br\s*/?\s*>\s*</div>\s*){20,}'
28    )
29    or (
30      regex.icontains(body.html.raw,
31                      '(?:<p[^>]*>\s*<o:p>\s*(?:&nbsp;|&#160;)\s*</o:p>\s*</p>\s*){10,}',
32                      '(?:<p[^>]*>\s*(?:&nbsp;|&#160;)\s*</p>\s*){30,}'
33      )
34      and (
35        any(ml.nlu_classifier(body.current_thread.text).intents,
36            .name in ("cred_theft", "bec")
37        )
38        or any(body.current_thread.links,
39               strings.ends_with(.href_url.path, 'php')
40        )
41      )
42    )
43  )
44  // low word count excludes legitimate long threads
45  and regex.count(body.html.display_text, '\S+') < 3000
46  
47  // visible link in current thread pointing to external domain
48  and any(body.current_thread.links,
49          .href_url.domain.root_domain != sender.email.domain.root_domain
50          and .href_url.domain.valid
51          and .href_url.scheme in ("https", "http")
52          and .visible == true
53  )
54  
55  // credential phishing has few visible links - newsletters have many
56  and length(filter(body.current_thread.links,
57                    .href_url.domain.valid
58                    and .href_url.scheme in ("https", "http")
59                    and .visible == true
60             )
61  ) < 10
62  
63  // negate high trust senders that pass auth
64  and not (
65    sender.email.domain.root_domain in $high_trust_sender_root_domains
66    and coalesce(headers.auth_summary.dmarc.pass, false)
67  )
68  
69  // negate authenticated senders with unsubscribe mechanism (marketing)
70  and not (
71    coalesce(headers.auth_summary.dmarc.pass, false)
72    and any(body.current_thread.links,
73            strings.icontains(.display_text, "unsubscribe")
74            or strings.icontains(.href_url.path, "unsubscribe")
75    )
76  )  
77tags:
78 - "Attack surface reduction"
79attack_types:
80  - "Credential Phishing"
81tactics_and_techniques:
82  - "Evasion"
83  - "Social engineering"
84detection_methods:
85  - "Content analysis"
86  - "HTML analysis"
87  - "Header analysis"
88id: "f8a3c1d2-7e4b-4a9f-b6c8-2d1e5f3a7b9c"