Fake email quarantine notification

  1name: "Fake email quarantine notification"
  2description: "Detects phishing messages implying that emails have been delayed or blocked, prompting users to view, release, or delete pending messages."
  3type: "rule"
  4severity: "high"
  5source: |
  6  type.inbound
  7  and length(body.links) < 10
  8  and (
  9    any(ml.nlu_classifier(body.current_thread.text).intents,
 10        .name == "cred_theft" and .confidence == "high"
 11    )
 12    or (
 13      length(body.current_thread.text) < 250
 14      and any(recipients.to,
 15              strings.icontains(body.current_thread.text, .email.domain.sld)
 16              or strings.icontains(body.current_thread.text, .email.local_part)
 17      )
 18    )
 19  )
 20  and not (
 21    length(ml.nlu_classifier(body.current_thread.text).topics) == 1
 22    and any(ml.nlu_classifier(body.current_thread.text).topics,
 23            .name == "Financial Communications" and .confidence != "low"
 24    )
 25  )
 26  and 3 of (
 27    strings.ilike(body.current_thread.text, "*review*"),
 28    strings.ilike(body.current_thread.text, "*incoming*"),
 29    strings.ilike(body.current_thread.text, "*release*"),
 30    strings.ilike(body.current_thread.text, "*quarantine*"),
 31    strings.ilike(body.current_thread.text, "*messages*"),
 32    strings.ilike(body.current_thread.text, "*server error*"),
 33    strings.ilike(body.current_thread.text, "*blocked*"),
 34    strings.ilike(body.current_thread.text, "*prevented*"),
 35    strings.ilike(body.current_thread.text, "*validation*"),
 36    strings.ilike(body.current_thread.text, "*notification*"),
 37    strings.ilike(body.current_thread.text, "*kindly*"),
 38    strings.ilike(body.current_thread.text, "*held*"),
 39    strings.ilike(body.current_thread.text, "*pending*"),
 40    strings.ilike(body.current_thread.text, "*stuck*"),
 41    strings.like(body.current_thread.text, "* MX *"),
 42    regex.icontains(body.current_thread.text, '(?:message|mail)s? on.?hold'),
 43    regex.icontains(body.current_thread.text,
 44                    'mail.?account.?(?:suspen|protect|violat)',
 45                    'account (?:suspen|protect|violat).{1,50}(?:e?.?mail)'
 46    )
 47  )
 48  and (
 49    any(body.links,
 50        regex.icontains(.display_text,
 51                        "view",
 52                        "release",
 53                        "message",
 54                        "delete",
 55                        "recover",
 56                        "SSO",
 57                        "sign in",
 58                        "resolve issue"
 59        )
 60    )
 61    or (
 62      length(body.links) < 3
 63      and any(body.links,
 64              any(recipients.to,
 65                  .email.domain.root_domain == ..display_url.domain.root_domain
 66                  and ..mismatched
 67              )
 68      )
 69    )
 70  )
 71  and not any(body.links,
 72              regex.icontains(.display_text,
 73                              "view document",
 74                              "review (&|and) sign document"
 75              )
 76  )
 77  and sender.email.domain.root_domain not in (
 78    "bing.com",
 79    "microsoft.com",
 80    "microsoftonline.com",
 81    "microsoftsupport.com",
 82    "microsoft365.com",
 83    "office.com",
 84    "office365.com",
 85    "onedrive.com",
 86    "sharepointonline.com",
 87    "yammer.com",
 88    "ppops.net"
 89  )
 90  
 91  // negate org domains unless they fail DMARC authentication
 92  and (
 93    (
 94      sender.email.domain.root_domain in $org_domains
 95      and (
 96        not headers.auth_summary.dmarc.pass
 97        // MS quarantine digest emails from an org domain are router "internally" to MS, therefore, there is no authentication information
 98        or not (
 99          headers.auth_summary.dmarc.pass is null
100          and all(headers.domains,
101                  .root_domain in (
102                    "outlook.com",
103                    "office365.com",
104                    "exchangelabs.com"
105                  )
106          )
107          // typical emails from freemail Outlook accounts are from prod.outlook.com
108          and strings.ends_with(headers.message_id, "protection.outlook.com>")
109        )
110      )
111    )
112    or sender.email.domain.root_domain not in $org_domains
113  )
114  
115  // negate highly trusted sender domains unless they fail DMARC authentication
116  and (
117    (
118      sender.email.domain.root_domain in $high_trust_sender_root_domains
119      and not headers.auth_summary.dmarc.pass
120    )
121    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
122  )
123  and not profile.by_sender().solicited
124  and not profile.by_sender().any_messages_benign  
125attack_types:
126  - "Credential Phishing"
127tactics_and_techniques:
128  - "Social engineering"
129detection_methods:
130  - "Content analysis"
131  - "Natural Language Understanding"
132  - "Sender analysis"
133id: "73f26a3d-b7a5-5b85-83e6-45f1b40f78fb"