Self-sent fake PDF attachment with misleading link

 1name: "Self-sent fake PDF attachment with misleading link"
 2description: "Detects messages sent from a user to themselves containing a fake PDF icon from Google's CDN, claiming to have an attachment while only containing images, and including links that appear to be PDF files."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  // a pdf icon directly before a current-thread link ending in .pdf
 8  and any(html.xpath(body.html,
 9                     '//a[preceding-sibling::*[1][self::img or .//img] or parent::*/preceding-sibling::*[1][self::img or .//img]]'
10          ).nodes,
11          any(.links,
12              strings.iends_with(.display_text, '.pdf')
13              and .href_url.url in map(body.current_thread.links, .href_url.url)
14          )
15          and any(html.xpath(.,
16                             'preceding-sibling::*[1]/descendant-or-self::img/@src | parent::*/preceding-sibling::*[1]/descendant-or-self::img/@src'
17                  ).nodes,
18                  // an inline (cid) image
19                  any(attachments,
20                      strings.iends_with(..raw,
21                                         strings.concat("cid:", .content_id)
22                      )
23                  )
24                  // or office's pdf file-icon (sometimes proxied by gmail)
25                  or strings.icontains(.raw, '/assets/mail/file-icon/png/pdf')
26          )
27  )
28  // no real attachments, only images
29  and all(attachments, .file_type in $file_types_images)
30  // self sender
31  and (
32    length(recipients.to) == 1
33    and sender.email.email == recipients.to[0].email.email
34  )  
35attack_types:
36  - "Credential Phishing"
37tactics_and_techniques:
38  - "Evasion"
39  - "Free subdomain host"
40  - "Social engineering"
41detection_methods:
42  - "Content analysis"
43  - "URL analysis"
44  - "Sender analysis"
45id: "8a285d2e-3e40-5dfa-b269-947011663a5a"