Brand impersonation: Google Meet with malicious link

 1name: "Brand impersonation: Google Meet with malicious link"
 2description: "Detects messages with 'Join with Google Meet' display text that redirects to domains other than meet.google.com."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.current_thread.links,
 8          .display_text in (
 9            "Join with Google Meet",
10            "Reply or Join with Google Meet"
11          )
12          and not strings.contains(.href_url.domain.domain, "meet.google.com")
13  )
14  and (
15    // finding the logo tag in the html
16    any(html.xpath(body.html, '//img[@alt="[Optional Logo]"]').nodes,
17        .raw is not null
18    )
19    or any(html.xpath(body.html, '//img[@alt="Google Meet"]').nodes,
20           .raw is not null
21    )
22    // OR find the green button
23    or any(html.xpath(body.html, '//a[contains(@style, "rgb(52,168,83)")]').nodes,
24           .display_text == "Join with Google Meet"
25    )
26  )
27  // finding the "Guests"/"Join by phone" tables NOT being present in the message is a good way to filter out the legit messages.
28  and length(html.xpath(body.html,
29                        '//table/tbody/tr/td/h2[contains(@style, "color:rgb(60,64,67)")]'
30             ).nodes
31  ) == 0
32  // we're filtering out some more "generic" table heading for google meets with this one
33  and not any(distinct(map(html.xpath(body.html, '//table//h2').nodes,
34                           .inner_text
35                       )
36              ),
37              . in ("Meeting link", "Join by phone", "Guests")
38  )  
39attack_types:
40  - "Credential Phishing"
41tactics_and_techniques:
42  - "Impersonation: Brand"
43  - "Social engineering"
44detection_methods:
45  - "Content analysis"
46  - "URL analysis"
47id: "d488d85a-fb02-5b40-a902-03ba0784ad35"