Credential phishing: Onedrive impersonation
This rule detects messages impersonating Microsoft's OneDrive service with medium to high credential theft language in the current thread. The subject is inspected for one drive language, with additional checks for free_subdomain hosted links, additional suspicious subject language or suspicious display text language.
Sublime rule (View on GitHub)
1name: "Credential phishing: Onedrive impersonation"
2description: "This rule detects messages impersonating Microsoft's OneDrive service with medium to high credential theft language in the current thread. The subject is inspected for one drive language, with additional checks for free_subdomain hosted links, additional suspicious subject language or suspicious display text language."
3type: "rule"
4severity: "high"
5source: |
6 type.inbound
7 // one drive is found in the sender display name or sender local part
8 and (
9 (
10 regex.icontains(sender.display_name, '[0o]ne\s?dr[il1]ve')
11 or regex.icontains(sender.email.local_part, '[0o]ne\s?dr[il1]ve')
12 or 0 < strings.ilevenshtein(strings.replace_confusables(sender.display_name),
13 "one?drive"
14 ) < 2
15 or any(attachments,
16 regex.icontains(.file_name, '[0o]ne\s?dr[il1]ve')
17 and not any(file.explode(.),
18 any(.scan.exiftool.fields,
19 .key == "Model"
20 or (
21 .key == "Software"
22 and strings.starts_with(.value, "Android")
23 )
24 )
25 // exclude images taken with mobile cameras and screenshots from Apple
26 or any(.scan.exiftool.fields,
27 .key == "DeviceManufacturer"
28 and .value == "Apple Computer Inc."
29 )
30 )
31 )
32 )
33 or regex.imatch(body.current_thread.text, '[0o]ne\s?dr[il1]ve.*')
34 // or one drive is in the subject with a freefile host, additional suspicious language, or suspicious display text
35 or (
36 regex.icontains(strings.replace_confusables(subject.subject),
37 '[0o]ne\s?dr[il1]ve'
38 )
39 and (
40 any(body.links,
41 .href_url.domain.root_domain in $free_subdomain_hosts
42 and .href_url.domain.subdomain is not null
43 and .href_url.domain.subdomain != "www"
44 )
45 or regex.contains(subject.subject, '(shared.{0,30}document)')
46 or any(body.links,
47 regex.icontains(.display_text,
48 "((view|show|access).(?:report|document)|review doc|view doc|view.attached)"
49 )
50 )
51 )
52 )
53 or (
54 any(beta.ml_topic(body.current_thread.text).topics,
55 .name == "File Sharing and Cloud Services" and .confidence == "high"
56 )
57 // more than half of the links with display text contain the keyword "onedrive"
58 and ratio(filter(body.links, .display_text is not null),
59 regex.icontains(.display_text, '[0o]ne\s?dr[il1]ve')
60 ) > 0.5
61 )
62 )
63
64 // and body language is med/high confidence cred theft
65 and (
66 any(ml.nlu_classifier(body.current_thread.text).intents,
67 .name == "cred_theft" and .confidence in ("medium", "high")
68 )
69 or any(ml.nlu_classifier(beta.ocr(beta.message_screenshot()).text).intents,
70 .name == "cred_theft" and .confidence in ("medium", "high")
71 )
72 )
73 and length(body.links) < 10
74 and sender.email.domain.root_domain not in (
75 "bing.com",
76 "microsoft.com",
77 "microsoftonline.com",
78 "microsoftsupport.com",
79 "microsoft365.com",
80 "office.com",
81 "onedrive.com",
82 "sharepointonline.com",
83 "yammer.com",
84 )
85
86 // negate highly trusted sender domains unless they fail DMARC authentication
87 and (
88 (
89 sender.email.domain.root_domain in $high_trust_sender_root_domains
90 and not headers.auth_summary.dmarc.pass
91 )
92 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
93 )
94
95 // excludes docusign senders that contain "via" in the display name
96 and not (
97 any(headers.hops,
98 any(.fields,
99 .name == "X-Api-Host" and strings.ends_with(.value, "docusign.net")
100 )
101 )
102 and strings.contains(sender.display_name, "via")
103 )
104 and not profile.by_sender().any_messages_benign
105
106attack_types:
107 - "Credential Phishing"
108tactics_and_techniques:
109 - "Free subdomain host"
110 - "Impersonation: Brand"
111 - "Social engineering"
112detection_methods:
113 - "Content analysis"
114 - "Header analysis"
115 - "Natural Language Understanding"
116 - "URL analysis"
117id: "1f990c92-a6d5-5a0b-9462-ac469a8d556e"