Brand impersonation: Dropbox

  1name: "Brand impersonation: Dropbox"
  2description: |
  3    Impersonation of Dropbox, a file sharing service.
  4type: "rule"
  5severity: "medium"
  6source: |
  7  type.inbound
  8  and (
  9    strings.ilike(sender.display_name, '*dropbox*')
 10    or strings.ilevenshtein(sender.display_name, 'dropbox') <= 1
 11    or strings.ilike(sender.email.domain.domain, '*dropbox*')
 12    or any(body.links,
 13           .display_url.domain.root_domain == "dropbox.com"
 14           and .mismatched
 15           and not .href_url.domain.root_domain in (
 16             "mimecast.com",
 17             "mimecastprotect.com"
 18           )
 19    )
 20    or regex.icontains(body.current_thread.text,
 21                       'invited you to view the file ".*" on Dropbox',
 22                       'dr[o0]pb[o0]x.{0,20}share.{0,20}f[i1|][i1|l]es?',
 23                       'dropbox sign (?:account|team)'
 24    )
 25    // dropbox style button
 26    or length(html.xpath(body.html,
 27                         "//a[contains(@style, 'background-color: #0070e0') and contains(@style, 'color: white') and contains(@style, 'width: 210px')  and contains(@style, 'max-width: 210px') and contains(@style, 'border-radius: 4px') and contains(@style, 'text-align: center') and contains(@style, 'font-size: 15px')]"
 28              ).nodes
 29    ) == 1
 30  )
 31  and sender.email.domain.root_domain not in~ (
 32    'dropbox.com',
 33    'dropboxforum.com',
 34    'dropboxsign.com'
 35  )
 36  and (
 37    any(attachments,
 38        .file_type in $file_types_images
 39        and any(file.explode(.), strings.ilike(.scan.ocr.raw, "*dropbox*"))
 40    )
 41    or any(body.links,
 42           (
 43             (
 44               strings.ilike(.display_text,
 45                             "*review*",
 46                             "*sign*",
 47                             "*view*",
 48                             "*completed document*",
 49                             "*open agreement*",
 50                             "*open document*",
 51                             "*open file*"
 52               )
 53               and not strings.ilike(.display_text, "*view this email in*")
 54             )
 55             or (
 56               .display_text is null
 57               and .href_url.domain.root_domain in $free_file_hosts
 58             )
 59           )
 60           and (
 61             .href_url.domain.root_domain != "dropbox.com"
 62             and any(ml.nlu_classifier(body.current_thread.text).intents,
 63                     .name == "cred_theft" and .confidence in ("medium", "high")
 64             )
 65           )
 66    )
 67    or (
 68      length(ml.logo_detect(file.message_screenshot()).brands) != 0
 69      and all(ml.logo_detect(file.message_screenshot()).brands,
 70              .name == "Dropbox"
 71      )
 72    )
 73  )
 74  and sender.email.email not in $recipient_emails
 75  
 76  // negate dropbox fax (aka hellofax)
 77  and not sender.email.domain.root_domain == 'hellofax.com'
 78  
 79  // negate iCloud Private Message Relay
 80  and not (
 81    sender.email.domain.domain == "privaterelay.appleid.com"
 82    or any(headers.hops, any(.fields, .name == "X-ICLOUD-HME"))
 83  )
 84  
 85  // negate highly trusted sender domains unless they fail DMARC authentication
 86  and (
 87    (
 88      sender.email.domain.root_domain in $high_trust_sender_root_domains
 89      and not headers.auth_summary.dmarc.pass
 90    )
 91    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
 92  )  
 93attack_types:
 94  - "Credential Phishing"
 95tactics_and_techniques:
 96  - "Impersonation: Brand"
 97  - "Social engineering"
 98detection_methods:
 99  - "Content analysis"
100  - "File analysis"
101  - "Header analysis"
102  - "Sender analysis"
103id: "61f11d12-7033-53c9-a95a-df982ff31c4b"