Brand impersonation: Adobe with suspicious language and link

  1name: "Brand impersonation: Adobe with suspicious language and link"
  2description: "Email contains an Adobe logo, at least one link, and suspicious link language from a new sender."
  3type: "rule"
  4severity: "high"
  5source: |
  6  type.inbound
  7  // all attachments are images or 0 attachments
  8  and (
  9    (
 10      length(attachments) > 0
 11      and all(attachments, .file_type in $file_types_images)
 12    )
 13    or length(attachments) == 0
 14  )
 15  and length(body.links) > 0
 16  and (
 17    any(ml.logo_detect(beta.message_screenshot()).brands,
 18        .name == "Adobe" and .confidence in ("high")
 19    )
 20    or (
 21      strings.icontains(body.current_thread.text, "adobe")
 22      and (
 23        // leverage topic analysis to pick up on themes
 24        (
 25          length(beta.ml_topic(body.current_thread.text).topics) == 1
 26          and all(beta.ml_topic(body.current_thread.text).topics,
 27                  .name == "File Sharing and Cloud Services"
 28                  and .confidence != "low"
 29          )
 30        )
 31        // keywords if topic anlayis doesn't match
 32        or strings.icontains(body.current_thread.text, 'review the document')
 33        or strings.icontains(body.current_thread.text, 'access file')
 34  
 35      )
 36      and length(body.current_thread.text) < 2000
 37    )
 38  )
 39  and (
 40    any(file.explode(beta.message_screenshot()),
 41        strings.ilike(.scan.ocr.raw,
 42                      "*review*",
 43                      "*sign*",
 44                      "*view*",
 45                      "open",
 46                      "*completed document*",
 47                      "*open agreement*",
 48                      "*open document*"
 49        )
 50        and not strings.ilike(.scan.ocr.raw,
 51                              "*view this email*",
 52                              "*view*browser*",
 53                              "*business review*"
 54        )
 55    )
 56    or any(body.links,
 57           strings.ilike(.display_text,
 58                         "*review*",
 59                         "*sign*",
 60                         "*view*",
 61                         "open",
 62                         "*completed document*",
 63                         "*open agreement*",
 64                         "*open document*"
 65           )
 66           and not strings.ilike(.display_text,
 67                                 "*view this email*",
 68                                 "*view*browser*"
 69           )
 70    )
 71  )
 72  and (
 73    (
 74      (
 75        length(headers.references) > 0
 76        or not any(headers.hops,
 77                   any(.fields, strings.ilike(.name, "In-Reply-To"))
 78        )
 79      )
 80      and not (
 81        (
 82          strings.istarts_with(subject.subject, "RE:")
 83          or strings.istarts_with(subject.subject, "RES:")
 84          or strings.istarts_with(subject.subject, "R:")
 85          or strings.istarts_with(subject.subject, "ODG:")
 86          or strings.istarts_with(subject.subject, "答复:")
 87          or strings.istarts_with(subject.subject, "AW:")
 88          or strings.istarts_with(subject.subject, "TR:")
 89          or strings.istarts_with(subject.subject, "FWD:")
 90          or regex.imatch(subject.subject,
 91                          '^\[?/{0,2}(EXT|EXTERNAL)\]?/{0,2}[: ]\s*(RE|FWD?|FW|AW|TR|ODG|答复):.*'
 92          )
 93        )
 94      )
 95    )
 96    or length(headers.references) == 0
 97  )
 98  and (
 99    (
100      headers.auth_summary.spf.pass
101      and headers.auth_summary.dmarc.pass
102      and (
103        not profile.by_sender().solicited
104        or profile.by_sender().any_messages_malicious_or_spam
105        or profile.by_sender_email().days_since.last_contact > 14
106      )
107      and not profile.by_sender().any_messages_benign
108      and not sender.email.domain.root_domain in ("adobe-events.com", "frame.io")
109    )
110    or not headers.auth_summary.spf.pass
111    or headers.auth_summary.spf.pass is null
112    or not headers.auth_summary.dmarc.pass
113    or headers.auth_summary.dmarc.pass is null
114  )
115  // negate highly trusted sender domains unless they fail DMARC authentication
116  and (
117    (
118      sender.email.domain.root_domain in $high_trust_sender_root_domains
119      and not headers.auth_summary.dmarc.pass
120    )
121    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
122  )  
123attack_types:
124  - "Credential Phishing"
125tactics_and_techniques:
126  - "Impersonation: Brand"
127  - "Social engineering"
128detection_methods:
129  - "Computer Vision"
130  - "Content analysis"
131  - "Header analysis"
132  - "Sender analysis"
133id: "32cc8bf1-f4d7-549f-a970-eade24b7c6ae"