ClickFunnels link infrastructure abuse

  1name: "ClickFunnels link infrastructure abuse"
  2description: "Email contains a ClickFunnels (mass mailing platform) tracking link but does not originate from ClickFunnels sending infrastructure. The myclickfunnels.com domain has been abused by threat actors to attempt credential phishing."
  3type: "rule"
  4severity: "high"
  5source: |
  6  type.inbound
  7  and (
  8    (
  9      length(body.links) < 15
 10      and any(body.links, .href_url.domain.root_domain == "myclickfunnels.com")
 11    )
 12    or (
 13      length(attachments) <= 3
 14      and (
 15        any(attachments,
 16            (.file_type in $file_types_images or .file_type == "pdf")
 17            and any(file.explode(.),
 18                    .scan.qr.type is not null
 19                    and .scan.qr.url.domain.root_domain == "myclickfunnels.com"
 20                    // exclude images taken with mobile cameras and screenshots from android
 21                    and not any(.scan.exiftool.fields,
 22                                .key == "Model"
 23                                or (
 24                                  .key == "Software"
 25                                  and strings.starts_with(.value, "Android")
 26                                )
 27                    )
 28                    // exclude images taken with mobile cameras and screenshots from Apple
 29                    and not any(.scan.exiftool.fields,
 30                                .key == "DeviceManufacturer"
 31                                and .value == "Apple Computer Inc."
 32                    )
 33            )
 34        )
 35        or (
 36          length(attachments) == 0
 37          //
 38          // This rule makes use of a beta feature and is subject to change without notice
 39          // using the beta feature in custom rules is not suggested until it has been formally released
 40          //
 41          and beta.parse_exif(file.message_screenshot()).image_height < 2000
 42          and beta.parse_exif(file.message_screenshot()).image_width < 2000
 43          and any(beta.scan_qr(file.message_screenshot()).items,
 44                  .type is not null
 45                  and .url.domain.root_domain == "myclickfunnels.com"
 46          )
 47        )
 48      )
 49    )
 50    or (
 51      length(attachments) <= 3
 52      and (
 53        any(attachments,
 54            (
 55              .file_type in ("pdf")
 56              or .file_extension in ("pdf", "eml")
 57              or .file_extension in $file_extensions_macros
 58              or (
 59                .content_type in ("message/rfc822") or .file_extension in ('eml')
 60              )
 61            )
 62            and any(file.explode(.),
 63                    any(.scan.url.urls,
 64                        .domain.root_domain == "myclickfunnels.com"
 65                    )
 66            )
 67        )
 68      )
 69    )
 70  )
 71  and not (
 72    any(headers.domains, strings.ends_with(.domain, "mailer.myclickfunnels.com"))
 73    or (
 74      (
 75        any(headers.hops,
 76            .index == 0
 77            and any(.authentication_results.dkim_details,
 78                    .domain == "mailer.myclickfunnels.com"
 79            )
 80        )
 81      )
 82      and any(distinct(headers.hops, .authentication_results.dmarc is not null),
 83              .index == 0
 84              and strings.ilike(.authentication_results.dmarc, "*pass")
 85      )
 86    )
 87  )
 88  // negating legit replies
 89  and not (
 90    (
 91      strings.istarts_with(subject.subject, "RE:")
 92      or strings.istarts_with(subject.subject, "FW:")
 93      or strings.istarts_with(subject.subject, "FWD:")
 94      or strings.istarts_with(subject.subject, "Automatic reply:")
 95    )
 96    and (
 97      length(headers.references) > 0
 98      and any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
 99    )
100  )
101  // negate highly trusted sender domains unless they fail DMARC authentication
102  and (
103    (
104      sender.email.domain.root_domain in $high_trust_sender_root_domains
105      and (
106        any(distinct(headers.hops, .authentication_results.dmarc is not null),
107            strings.ilike(.authentication_results.dmarc, "*fail")
108        )
109      )
110    )
111    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
112  )  
113attack_types:
114  - "Credential Phishing"
115tactics_and_techniques:
116  - "Free email provider"
117  - "Free subdomain host"
118  - "Social engineering"
119detection_methods:
120  - "Content analysis"
121  - "Header analysis"
122  - "QR code analysis"
123  - "Sender analysis"
124  - "URL analysis"
125id: "9192fbe9-c04d-5347-9fe8-7969e843ac85"