ClickFunnels link infrastructure abuse

  1name: "ClickFunnels link infrastructure abuse"
  2description: "Email contains a ClickFunnels (mass mailing platform) tracking link but does not originate from ClickFunnels sending infrastructure. The myclickfunnels.com domain has been abused by threat actors to attempt credential phishing."
  3type: "rule"
  4severity: "high"
  5source: |
  6  type.inbound
  7  and (
  8    (
  9      length(body.links) < 15
 10      and any(body.links, .href_url.domain.root_domain == "myclickfunnels.com")
 11    )
 12    or (
 13      length(attachments) <= 3
 14      and (
 15        any(attachments,
 16            (.file_type in $file_types_images or .file_type == "pdf")
 17            and any(file.explode(.),
 18                    .scan.qr.type is not null
 19                    and .scan.qr.url.domain.root_domain == "myclickfunnels.com"
 20                    // exclude images taken with mobile cameras and screenshots from android
 21                    and not any(.scan.exiftool.fields,
 22                                .key == "Model"
 23                                or (
 24                                  .key == "Software"
 25                                  and strings.starts_with(.value, "Android")
 26                                )
 27                    )
 28                    // exclude images taken with mobile cameras and screenshots from Apple
 29                    and not any(.scan.exiftool.fields,
 30                                .key == "DeviceManufacturer"
 31                                and .value == "Apple Computer Inc."
 32                    )
 33            )
 34        )
 35        or (
 36          length(attachments) == 0
 37          //
 38          // This rule makes use of a beta feature and is subject to change without notice
 39          // using the beta feature in custom rules is not suggested until it has been formally released
 40          //
 41          and beta.parse_exif(file.message_screenshot()).image_height < 2000
 42          and beta.parse_exif(file.message_screenshot()).image_width < 2000
 43          and any(beta.scan_qr(file.message_screenshot()).items,
 44                  .type is not null
 45                  and .url.domain.root_domain == "myclickfunnels.com"
 46          )
 47        )
 48      )
 49    )
 50    or (
 51      length(attachments) <= 3
 52      and (
 53        any(attachments,
 54            (
 55              .file_type in ("pdf")
 56              or .file_extension in ("pdf", "eml")
 57              or .file_extension in $file_extensions_macros
 58              or .content_type in ("message/rfc822")
 59            )
 60            and any(file.explode(.),
 61                    any(.scan.url.urls,
 62                        .domain.root_domain == "myclickfunnels.com"
 63                    )
 64            )
 65        )
 66      )
 67    )
 68  )
 69  and not (
 70    any(headers.domains, strings.ends_with(.domain, "mailer.myclickfunnels.com"))
 71    or (
 72      (
 73        any(headers.hops,
 74            .index == 0
 75            and any(.authentication_results.dkim_details,
 76                    .domain == "mailer.myclickfunnels.com"
 77            )
 78        )
 79      )
 80      and any(distinct(headers.hops, .authentication_results.dmarc is not null),
 81              .index == 0
 82              and strings.ilike(.authentication_results.dmarc, "*pass")
 83      )
 84    )
 85  )
 86  // negating legit replies
 87  and not (
 88    (
 89      strings.istarts_with(subject.subject, "RE:")
 90      or strings.istarts_with(subject.subject, "FW:")
 91      or strings.istarts_with(subject.subject, "FWD:")
 92      or strings.istarts_with(subject.subject, "Automatic reply:")
 93    )
 94    and (
 95      length(headers.references) > 0
 96      and any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
 97    )
 98  )
 99  // negate highly trusted sender domains unless they fail DMARC authentication
100  and (
101    (
102      sender.email.domain.root_domain in $high_trust_sender_root_domains
103      and (
104        any(distinct(headers.hops, .authentication_results.dmarc is not null),
105            strings.ilike(.authentication_results.dmarc, "*fail")
106        )
107      )
108    )
109    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
110  )
111  and profile.by_sender_email().prevalence in ("new", "outlier", "rare")  
112
113attack_types:
114  - "Credential Phishing"
115tactics_and_techniques:
116  - "Free email provider"
117  - "Free subdomain host"
118  - "Social engineering"
119detection_methods:
120  - "Content analysis"
121  - "Header analysis"
122  - "QR code analysis"
123  - "Sender analysis"
124  - "URL analysis"
125id: "9192fbe9-c04d-5347-9fe8-7969e843ac85"