Brand impersonation: Adobe with suspicious language and link

  1name: "Brand impersonation: Adobe with suspicious language and link"
  2description: "Email contains an Adobe logo, at least one link, and suspicious link language from a new sender."
  3type: "rule"
  4severity: "high"
  5source: |
  6  type.inbound
  7  // All attachments are images or 0 attachments
  8  and (
  9    (
 10      length(attachments) > 0
 11      and all(attachments, .file_type in $file_types_images)
 12    )
 13    or length(attachments) == 0
 14  )
 15  and length(body.links) > 0
 16  and (
 17    any(ml.logo_detect(file.message_screenshot()).brands,
 18        .name == "Adobe" and .confidence in ("high")
 19    )
 20    or (
 21      strings.icontains(body.current_thread.text, "adobe")
 22      and not strings.icontains(body.current_thread.text, "adobe marketplace")
 23      and not strings.icontains(body.current_thread.text, "adobe analytics")
 24      and (
 25        // Leverage topic analysis to pick up on themes
 26        (
 27          length(ml.nlu_classifier(body.current_thread.text).topics) == 1
 28          and all(ml.nlu_classifier(body.current_thread.text).topics,
 29                  .name == "File Sharing and Cloud Services"
 30                  and .confidence != "low"
 31          )
 32        )
 33        // Key phrases if topic anlayis doesn't match
 34        or strings.icontains(body.current_thread.text, 'review the document')
 35        or strings.icontains(body.current_thread.text, 'access file')
 36        or strings.icontains(body.current_thread.text, 'pending document')
 37        or any(body.links, strings.ilike(.display_text, 'review and sign'))
 38        or any(body.links, strings.ilike(.display_text, 'open document'))
 39      )
 40      and length(body.current_thread.text) < 2000
 41    )
 42  )
 43  and (
 44    (
 45      //
 46      // This rule makes use of a beta feature and is subject to change without notice
 47      // using the beta feature in custom rules is not suggested until it has been formally released
 48      //
 49      strings.ilike(beta.ocr(file.message_screenshot()).text,
 50                    "*review*",
 51                    "*sign*",
 52                    "*view*",
 53                    "open",
 54                    "*completed document*",
 55                    "*open agreement*",
 56                    "*open document*"
 57      )
 58      and not strings.ilike(beta.ocr(file.message_screenshot()).text,
 59                            "*view this email*",
 60                            "*view*browser*",
 61                            "*view online*",
 62                            "*business review*"
 63      )
 64    )
 65    or any(body.links,
 66           strings.ilike(.display_text,
 67                         "*review*",
 68                         "*sign*",
 69                         "*view*",
 70                         "open",
 71                         "*completed document*",
 72                         "*open agreement*",
 73                         "*open document*",
 74                         "*continue*"
 75           )
 76           and not strings.ilike(.display_text,
 77                                 "*view this email*",
 78                                 "*view*browser*",
 79                                 "*view online*"
 80           )
 81    )
 82  )
 83  // Negate replies & forwards
 84  and (
 85    (
 86      (length(headers.references) > 0 or headers.in_reply_to is null)
 87      and not (
 88        (
 89          strings.istarts_with(subject.subject, "RE:")
 90          or strings.istarts_with(subject.subject, "RES:")
 91          or strings.istarts_with(subject.subject, "R:")
 92          or strings.istarts_with(subject.subject, "ODG:")
 93          or strings.istarts_with(subject.subject, "答复:")
 94          or strings.istarts_with(subject.subject, "AW:")
 95          or strings.istarts_with(subject.subject, "TR:")
 96          or strings.istarts_with(subject.subject, "FWD:")
 97          or regex.imatch(subject.subject,
 98                          '^\[?/{0,2}(EXT|EXTERNAL)\]?/{0,2}[: ]\s*(RE|FWD?|FW|AW|TR|ODG|答复):.*'
 99          )
100        )
101      )
102    )
103    or length(headers.references) == 0
104  )
105  // Negate certain common topics
106  and not any(ml.nlu_classifier(body.current_thread.text).topics,
107              .name in (
108                "Advertising and Promotions",
109                "Events and Webinars",
110                "Professional and Career Development",
111                "Newsletters and Digests"
112              )
113              and .confidence != "low"
114  )
115  and (
116    (
117      headers.auth_summary.spf.pass
118      and headers.auth_summary.dmarc.pass
119      and (
120        not profile.by_sender().solicited
121        or profile.by_sender().any_messages_malicious_or_spam
122        or profile.by_sender_email().days_since.last_contact > 14
123      )
124      and not profile.by_sender().any_messages_benign
125      // Negate affiliates, sub-products & legitimate domains
126      and not sender.email.domain.root_domain in (
127        "adobe-events.com",
128        "frame.io",
129        "nudgesecurity.io",
130        "adobesignsandbox.com",
131        "magento.com",
132        "workfront.com"
133      )
134      // Continued
135      and not any(headers.domains, .root_domain == "zohomail.com")
136      and not strings.iends_with(headers.message_id, 'omniture.com>')
137    )
138    or not headers.auth_summary.spf.pass
139    or headers.auth_summary.spf.pass is null
140    or not headers.auth_summary.dmarc.pass
141    or headers.auth_summary.dmarc.pass is null
142  )
143  // Negate highly trusted sender domains unless they fail DMARC authentication
144  and (
145    (
146      sender.email.domain.root_domain in $high_trust_sender_root_domains
147      and not headers.auth_summary.dmarc.pass
148    )
149    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
150  )  
151attack_types:
152  - "Credential Phishing"
153tactics_and_techniques:
154  - "Impersonation: Brand"
155  - "Social engineering"
156detection_methods:
157  - "Computer Vision"
158  - "Content analysis"
159  - "Header analysis"
160  - "Sender analysis"
161id: "32cc8bf1-f4d7-549f-a970-eade24b7c6ae"