Credential Phishing: Suspicious subject with urgent financial request and link
This rule inspects messages where the subject is suspicious with less than 5 links and a relatively short body. Natural Language Understanding is being used to identify the inclusion of a financial, request, urgency and org entity from an unsolicited sender.
Sublime rule (View on GitHub)
1name: "Credential Phishing: Suspicious subject with urgent financial request and link"
2description: "This rule inspects messages where the subject is suspicious with less than 5 links and a relatively short body. Natural Language Understanding is being used to identify the inclusion of a financial, request, urgency and org entity from an unsolicited sender."
3type: "rule"
4severity: "medium"
5source: |
6 type.inbound
7 and 0 < length(body.links) < 5
8
9 // negate webinar registrations
10 and not any(body.links,
11 .display_text =~ "REGISTER NOW"
12 and .href_url.domain.root_domain == "secureclick.net"
13 )
14
15 // not all links are unsubscribe links
16 and not all(body.links,
17 (
18 strings.icontains(.display_text, "unsubscribe")
19 and strings.icontains(.href_url.path, "unsubscribe")
20 )
21 or (
22 strings.icontains(.display_text, "deactivate")
23 and strings.icontains(.href_url.path, "DeactivateAccount")
24 )
25 )
26
27 // ignore emails in body
28 and not all(body.links, .href_url.domain.domain in $free_email_providers)
29 and length(body.current_thread.text) < 2000
30 and length(subject.subject) < 100
31
32 // and suspicious subject
33 and regex.icontains(subject.subject,
34 // https://github.com/sublime-security/static-files/blob/master/suspicious_subjects_regex.txt
35 "termination.*notice",
36 "38417",
37 ":completed",
38 "[il1]{2}mit.*ma[il1]{2} ?bo?x",
39 "[il][il][il]egai[ -]",
40 "[li][li][li]ega[li] attempt",
41 "[ng]-?[io]n .*block",
42 "[ng]-?[io]n .*cancel",
43 "[ng]-?[io]n .*deactiv",
44 "[ng]-?[io]n .*disabl",
45 "action.*required",
46 "abandon.*package",
47 "about.your.account",
48 "acc(ou)?n?t (is )?on ho[li]d",
49 "acc(ou)?n?t.*terminat",
50 "acc(oun)?t.*[il1]{2}mitation",
51 "access.*limitation",
52 "account (will be )?block",
53 "account.*de-?activat",
54 "account.*locked",
55 "account.*re-verification",
56 "account.*security",
57 "account.*suspension",
58 "account.has.been",
59 "account.has.expired",
60 "account.will.be.blocked",
61 "account v[il]o[li]at",
62 "activity.*acc(oun)?t",
63 "almost.full",
64 "app[li]e.[il]d",
65 "authenticate.*account",
66 "been.*suspend",
67 "clos.*of.*account.*processed",
68 "confirm.your.account",
69 "courier.*able",
70 "deactivation.*in.*progress",
71 "delivery.*attempt.*failed",
72 "document.received",
73 "documented.*shared.*with.*you",
74 "dropbox.*document",
75 "e-?ma[il1]+ .{010}suspen",
76 "e-?ma[il1]{1} user",
77 "e-?ma[il1]{2} acc",
78 "e-?ma[il1]{2}.*up.?grade",
79 "e.?ma[il1]{2}.*server",
80 "e.?ma[il1]{2}.*suspend",
81 "email.update",
82 "faxed you",
83 "fraud(ulent)?.*charge",
84 "from.helpdesk",
85 "fu[il1]{2}.*ma[il1]+[ -]?box",
86 "has.been.*suspended",
87 "has.been.limited",
88 "have.locked",
89 "he[li]p ?desk upgrade",
90 "heipdesk",
91 "i[il]iega[il]",
92 "ii[il]ega[il]",
93 "incoming e?mail",
94 "incoming.*fax",
95 "lock.*security",
96 "ma[il1]{1}[ -]?box.*quo",
97 "ma[il1]{2}[ -]?box.*fu[il1]",
98 "ma[il1]{2}box.*[il1]{2}mit",
99 "ma[il1]{2}box stor",
100 "mail on.?hold",
101 "mail.*box.*migration",
102 "mail.*de-?activat",
103 "mail.update.required",
104 "mails.*pending",
105 "messages.*pending",
106 "missed.*shipping.*notification",
107 "missed.shipment.notification",
108 "must.update.your.account",
109 "new [sl][io]g?[nig][ -]?in from",
110 "new voice ?-?mail",
111 "notifications.*pending",
112 "office.*3.*6.*5.*suspend",
113 "office365",
114 "on google docs with you",
115 "online doc",
116 "password.*compromised",
117 "periodic maintenance",
118 "potential(ly)? unauthorized",
119 "refund not approved",
120 "revised.*policy",
121 "scam",
122 "scanned.?invoice",
123 "secured?.update",
124 "security breach",
125 "securlty",
126 "signed.*delivery",
127 "status of your .{314}? ?delivery",
128 "susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty",
129 "suspicious.*sign.*[io]n",
130 "suspicious.activit",
131 "temporar(il)?y deactivate",
132 "temporar[il1]{2}y disab[li]ed",
133 "temporarily.*lock",
134 "un-?usua[li].activity",
135 "unable.*deliver",
136 "unauthorized.*activit",
137 "unauthorized.device",
138 "unauthorized.sign.?in",
139 "unrecognized.*activit",
140 "unrecognized.sign.?in",
141 "unrecognized.*activit",
142 "undelivered message",
143 "unread.*doc",
144 "unusual.activity",
145 "upgrade.*account",
146 "upgrade.notice",
147 "urgent message",
148 "urgent.verification",
149 "v[il1]o[li1]at[il1]on security",
150 "va[il1]{1}date.*ma[il1]{2}[ -]?box",
151 "verification ?-?require",
152 "verification( )?-?need",
153 "verify.your?.account",
154 "web ?-?ma[il1]{2}",
155 "web[ -]?ma[il1]{2}",
156 "will.be.suspended",
157 "your (customer )?account .as",
158 "your.office.365",
159 "your.online.access",
160
161 // https://github.com/sublime-security/static-files/blob/master/suspicious_subjects.txt
162 "account has been limited",
163 "action required",
164 "almost full",
165 "apd notifi cation",
166 "are you at your desk",
167 "are you available",
168 "attached file to docusign",
169 "banking is temporarily unavailable",
170 "bankofamerica",
171 "closing statement invoice",
172 "completed: docusign",
173 "de-activation of",
174 "delivery attempt",
175 "delivery stopped for shipment",
176 "detected suspicious",
177 "detected suspicious actvity",
178 "docu sign",
179 "document for you",
180 "document has been sent to you via docusign",
181 "document is ready for signature",
182 "docusign",
183 "encrypted message",
184 "failed delivery",
185 "fedex tracking",
186 "file was shared",
187 "freefax",
188 "fwd: due invoice paid",
189 "has shared",
190 "inbox is full",
191 "invitation to comment",
192 "invitation to edit",
193 "invoice due",
194 "left you a message",
195 "message from",
196 "new message",
197 "new voicemail",
198 "on desk",
199 "out of space",
200 "password reset",
201 "payment status",
202 "quick reply",
203 "re: w-2",
204 "required",
205 "required: completed docusign",
206 "ringcentral",
207 "scanned image",
208 "secured files",
209 "secured pdf",
210 "security alert",
211 "new sign-in",
212 "new sign in",
213 "sign-in attempt",
214 "sign in attempt",
215 "staff review",
216 "suspicious activity",
217 "unrecognized login attempt",
218 "upgrade immediately",
219 "urgent",
220 "wants to share",
221 "w2",
222 "you have notifications pending",
223 "your account",
224 "your amazon order",
225 "your document settlement",
226 "your order with amazon",
227 "your password has been compromised",
228 )
229
230 // language attempting to engage
231 and any(ml.nlu_classifier(body.current_thread.text).entities,
232 .name == "request"
233 )
234
235 // financial request
236 and any(ml.nlu_classifier(body.current_thread.text).entities,
237 .name == "financial"
238 )
239
240 // urgency request
241 and any(ml.nlu_classifier(body.current_thread.text).entities,
242 .name == "urgency"
243 )
244
245 // org presence
246 and any(ml.nlu_classifier(body.current_thread.text).entities, .name == "org")
247
248 // not a reply
249 and (
250 not strings.istarts_with(subject.subject, "re:")
251 and not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
252 )
253
254 // the message is unsolicited and no false positives
255 and (
256 not profile.by_sender().solicited
257 or profile.by_sender().any_messages_malicious_or_spam
258 )
259 and not profile.by_sender().any_false_positives
260
261 // negate highly trusted sender domains unless they fail DMARC authentication
262 and (
263 (
264 sender.email.domain.root_domain in $high_trust_sender_root_domains
265 and not headers.auth_summary.dmarc.pass
266 )
267 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
268 )
269
270 // negation the only link is the senders email
271 and not (
272 regex.contains(body.current_thread.text,
273 "[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}"
274 )
275 and (
276 all(body.links, .href_url.domain.root_domain == sender.email.domain.domain)
277 )
278 )
279
280attack_types:
281 - "Credential Phishing"
282tactics_and_techniques:
283 - "Impersonation: Brand"
284 - "Social engineering"
285detection_methods:
286 - "Content analysis"
287 - "Header analysis"
288 - "Natural Language Understanding"
289 - "Sender analysis"
290id: "056464f4-7a16-5f07-ab86-912e0a64ecae"