ClickFunnels link infrastructure abuse

  1name: "ClickFunnels link infrastructure abuse"
  2description: "Email contains a ClickFunnels (mass mailing platform) tracking link but does not originate from ClickFunnels sending infrastructure. The myclickfunnels.com domain has been abused by threat actors to attempt credential phishing."
  3type: "rule"
  4severity: "high"
  5source: |
  6  type.inbound
  7  and (
  8    (
  9      length(body.links) < 15
 10      and any(body.links, .href_url.domain.root_domain == "myclickfunnels.com")
 11    )
 12    or (
 13      length(attachments) <= 3
 14      and (
 15        any(attachments,
 16            (.file_type in $file_types_images or .file_type == "pdf")
 17            and any(file.explode(.),
 18                    .scan.qr.type is not null
 19                    and .scan.qr.url.domain.root_domain == "myclickfunnels.com"
 20                    // exclude images taken with mobile cameras and screenshots from android
 21                    and not any(.scan.exiftool.fields,
 22                                .key == "Model"
 23                                or (
 24                                  .key == "Software"
 25                                  and strings.starts_with(.value, "Android")
 26                                )
 27                    )
 28                    // exclude images taken with mobile cameras and screenshots from Apple
 29                    and not any(.scan.exiftool.fields,
 30                                .key == "DeviceManufacturer"
 31                                and .value == "Apple Computer Inc."
 32                    )
 33            )
 34        )
 35        or (
 36          length(attachments) == 0
 37          and any(file.explode(beta.message_screenshot()),
 38                  .scan.exiftool.image_height < 2000
 39                  and .scan.exiftool.image_width < 2000
 40                  and .scan.qr.type is not null
 41                  and .scan.qr.url.domain.root_domain == "myclickfunnels.com"
 42          )
 43        )
 44      )
 45    )
 46    or (
 47      length(attachments) <= 3
 48      and (
 49        any(attachments,
 50            (
 51              .file_type in ("pdf")
 52              or .file_extension in ("pdf", "eml")
 53              or .file_extension in $file_extensions_macros
 54              or .content_type in ("message/rfc822")
 55            )
 56            and any(file.explode(.),
 57                    any(.scan.url.urls,
 58                        .domain.root_domain == "myclickfunnels.com"
 59                    )
 60            )
 61        )
 62      )
 63    )
 64  )
 65  and not (
 66    any(headers.domains, strings.ends_with(.domain, "mailer.myclickfunnels.com"))
 67    or (
 68      (
 69        any(headers.hops,
 70            .index == 0
 71            and any(.authentication_results.dkim_details,
 72                    .domain == "mailer.myclickfunnels.com"
 73            )
 74        )
 75      )
 76      and any(distinct(headers.hops, .authentication_results.dmarc is not null),
 77              .index == 0
 78              and strings.ilike(.authentication_results.dmarc, "*pass")
 79      )
 80    )
 81  )
 82  // negating legit replies
 83  and not (
 84    (
 85      strings.istarts_with(subject.subject, "RE:")
 86      or strings.istarts_with(subject.subject, "FW:")
 87      or strings.istarts_with(subject.subject, "FWD:")
 88      or strings.istarts_with(subject.subject, "Automatic reply:")
 89    )
 90    and (
 91      length(headers.references) > 0
 92      and any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
 93    )
 94  )
 95  // negate highly trusted sender domains unless they fail DMARC authentication
 96  and (
 97    (
 98      sender.email.domain.root_domain in $high_trust_sender_root_domains
 99      and (
100        any(distinct(headers.hops, .authentication_results.dmarc is not null),
101            strings.ilike(.authentication_results.dmarc, "*fail")
102        )
103      )
104    )
105    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
106  )
107  and profile.by_sender().prevalence in ("new", "outlier", "rare")
108    
109
110attack_types:
111  - "Credential Phishing"
112tactics_and_techniques:
113  - "Free email provider"
114  - "Free subdomain host"
115  - "Social engineering"
116detection_methods:
117  - "Content analysis"
118  - "Header analysis"
119  - "QR code analysis"
120  - "Sender analysis"
121  - "URL analysis"
122id: "9192fbe9-c04d-5347-9fe8-7969e843ac85"