Brand impersonation: Microsoft logo image linking to free file host

 1name: "Brand impersonation: Microsoft logo image linking to free file host"
 2description: "Detects inline images that display a Microsoft logo and contain text, used as clickable links within the message body. The link behind the image redirects to a self-service site creation platform or free file hosting domain rather than a legitimate Microsoft or tenant domain, a common technique for disguising credential phishing or malware delivery links as trusted Microsoft branded content."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(map(filter(attachments,
 8                     .file_type in $file_types_images
 9                     and .content_disposition =~ "inline"
10                     and any(ml.logo_detect(.).brands,
11                             strings.istarts_with(.name, "Microsoft")
12                             and .confidence == "high"
13                     )
14                     // big image
15                     and beta.parse_exif(.).image_height > 96
16                     and beta.parse_exif(.).image_width > 96
17                     // and there is text on the image
18                     and regex.icount(beta.ocr(.).text, '\w+\W') > 5
19              ),
20              .content_id
21          ),
22          // that image is used a a link in the body
23          any(html.xpath(body.html, '//a[.//img[@src]]').nodes,
24              strings.icontains(.raw, ..)
25              and any(.links,
26                      // the link goes to self_service for free_file_hosts
27                      (
28                        .href_url.domain.domain in $self_service_creation_platform_domains
29                        or .href_url.domain.root_domain in $self_service_creation_platform_domains
30                        or .href_url.domain.domain in $free_file_hosts
31                        or .href_url.domain.root_domain in $free_file_hosts
32                      )
33                      // but not sharepoint
34                      and not .href_url.domain.domain in $tenant_domains
35              )
36          )
37  )  
38attack_types:
39  - "Credential Phishing"
40  - "Malware/Ransomware"
41tactics_and_techniques:
42  - "Impersonation: Brand"
43  - "Image as content"
44  - "Free file host"
45  - "Social engineering"
46detection_methods:
47  - "Computer Vision"
48  - "Optical Character Recognition"
49  - "Exif analysis"
50  - "HTML analysis"
51  - "URL analysis"
52id: "b929c2fc-6328-5314-ade2-16b8fb19b321"