Suspicious newly registered reply-to domain with engaging financial or urgent language

 1name: "Suspicious newly registered reply-to domain with engaging financial or urgent language"
 2description: |
 3  Detects messages from a mismatched newly registered Reply-to domain that contain a financial or urgent request, or a request and 
 4  an NLU tag with medium to high confidence, from an untrusted sender. This technique is typically observed in Vendor impersonation.  
 5type: "rule"
 6severity: "medium"
 7source: |
 8  type.inbound
 9  and length(body.current_thread.text) < 5000
10  and (
11    any(headers.reply_to,
12        ( // mismatched reply-to and sender domain
13          .email.domain.root_domain != sender.email.domain.root_domain
14          // newly registered reply-to domain
15          and network.whois(.email.domain).days_old <= 30
16        )
17        or (
18          network.whois(.email.domain).days_old <= 90
19          and any(regex.iextract(body.current_thread.text,
20                                 'message id:\s*\S+@([a-z0-9.-]+\.[a-z]{2,})'
21                  ),
22                  .groups[0] != sender.email.domain.root_domain
23          )
24        )
25    )
26    or (
27      network.whois(sender.email.domain).days_old < 30
28      and sender.email.domain.tld in $suspicious_tlds
29    )
30  )
31  // request is being made
32  and any(ml.nlu_classifier(body.current_thread.text).entities,
33          .name == "request"
34  )
35  // there's financial/urgency OR a tag of medium/high confidence
36  and (
37    any(ml.nlu_classifier(body.current_thread.text).entities,
38        .name in ("financial", "urgency")
39    )
40    or any(ml.nlu_classifier(body.current_thread.text).tags,
41           .name is not null and .confidence in ("medium", "high")
42    )
43  )
44  and (
45    not profile.by_sender().solicited
46  
47    //
48    // This rule makes use of a beta feature and is subject to change without notice
49    // using the beta feature in custom rules is not suggested until it has been formally released
50    //
51    or not beta.profile.by_reply_to().solicited
52    or (
53      profile.by_sender().any_messages_malicious_or_spam
54      and not profile.by_sender().any_messages_benign
55    )
56  )
57  // negate highly trusted sender domains unless they fail DMARC authentication
58  and not (
59    sender.email.domain.root_domain in $high_trust_sender_root_domains
60    and coalesce(headers.auth_summary.dmarc.pass, false)
61  )  
62attack_types:
63  - "BEC/Fraud"
64tactics_and_techniques:
65  - "Social engineering"
66detection_methods:
67  - "Content analysis"
68  - "Header analysis"
69  - "Natural Language Understanding"
70  - "Sender analysis"
71  - "URL analysis"
72  - "Whois"
73id: "db4d9bb3-0eca-5525-9a99-7c1c773b580f"