Brand impersonation: Microsoft

  1name: "Brand impersonation: Microsoft"
  2description: |
  3    Impersonation of the Microsoft brand.
  4references:
  5  - "https://www.itproportal.com/news/cybercriminals-launch-targeted-phishing-attacks-against-microsoft-365-users/"
  6  - "https://cofense.com/blog/office-365-phishing-variant/"
  7  - "https://www.helpnetsecurity.com/2020/05/04/fake-microsoft-teams-notification/"
  8type: "rule"
  9severity: "high"
 10authors:
 11  - twitter: "amitchell516"
 12source: |
 13  type.inbound
 14  and (
 15    length(body.links) < 30
 16    or sender.email.local_part == "newsletter" and length(body.links) < 5
 17  )
 18  and (
 19    (
 20      strings.ilike(subject.subject, '*Microsoft 365*')
 21      and strings.ilike(subject.subject, '*is expired*')
 22    )
 23    or (
 24      // should catch any instance of the word "expired"
 25      strings.ilike(body.current_thread.text, "*expir*")
 26      and strings.ilike(body.current_thread.text, "*password*")
 27      and strings.ilike(body.current_thread.text, "*microsoft*")
 28    )
 29    or regex.icontains(body.current_thread.text,
 30                       ".*reach you.{0,20}Microsoft Teams"
 31    )
 32    or strings.ilike(sender.display_name, '*new activity in Teams*')
 33    or strings.icontains(strings.replace_confusables(sender.display_name),
 34                         'microsoft advertising support'
 35    )
 36    or subject.subject =~ 'Offline Message in Teams'
 37    or strings.ilike(subject.subject, '*Teams Sent A Message')
 38    or sender.display_name in~ (
 39      'Microsoft Partner Network',
 40      'Microsoft Advertising',
 41      'Microsoft',
 42      'Microsoft Feedback',
 43      'Microsoft account team',
 44      'Microsoft Support',
 45      'Microsoft 365 Message center',
 46      'Microsoft Azure'
 47    )
 48    or regex.icontains(sender.display_name,
 49                       "[MḾṀṂⱮМḿṁṃᵯⱮ𝐌𝑀][iíìîïīĭĩįıɪɨᵢⁱ𝐢𝑖][cćĉċčçƈȼ𝐜𝑐][rŕŗřȑȓɾᵣⁿʳ𝐫𝑟][oóòôõöøōŏőɵₒᵒº𝐨𝑜][sśŝšșşʂᵴˢˢ𝐬𝑠][oóòôõöøōŏőɵₒᵒº𝐨𝑜][fḟƒᵮᶠ𝐟𝑓][tťțţᵵₜᵗᵗ𝐭𝑡]"
 50    )
 51    or regex.icontains(sender.display_name,
 52                       "[MḾṀṂⱮМḿṁṃᵯⱮ𝐌𝑀][iíìîïīĭĩįıɪɨᵢⁱ𝐢𝑖][rŕŗřȑȓɾᵣⁿʳ𝐫𝑟][cćĉċčçƈȼ𝐜𝑐][oóòôõöøōŏőɵₒᵒº𝐨𝑜][sśŝšșşʂᵴˢˢ𝐬𝑠][oóòôõöøōŏőɵₒᵒº𝐨𝑜][fḟƒᵮᶠ𝐟𝑓][tťțţᵵₜᵗᵗ𝐭𝑡]" // [sic]
 53    )
 54  )
 55  and sender.email.domain.root_domain not in~ (
 56    'microsoft.com',
 57    'microsoftstoreemail.com',
 58    'microsoftsupport.com',
 59    'office.com',
 60    'teams-events.com',
 61    'qualtrics-research.com',
 62    'skype.com',
 63    'azureadnotifications.us',
 64    'microsoftonline.us',
 65    'mail.microsoft',
 66    'office365.com',
 67    'microsoftadvertising.com'
 68  )
 69  and not (
 70    sender.email.domain.domain in~ (
 71      'microsoft.regsvc.com',
 72      'microsoft.onmicrosoft.com'
 73    )
 74    and headers.auth_summary.dmarc.pass
 75  )
 76  and (
 77    profile.by_sender().prevalence in ("new", "outlier")
 78    or (
 79      profile.by_sender().any_messages_malicious_or_spam
 80      and not profile.by_sender().any_messages_benign
 81    )
 82  )
 83  
 84  // negate legitimate Office 365 bouncebacks
 85  and not (
 86    all(attachments,
 87        .content_type in ("message/delivery-status", "message/rfc822")
 88    )
 89    and (
 90      sender.email.local_part in ('postmaster', 'mailer-daemon')
 91      or strings.starts_with(sender.email.local_part, 'microsoftexchange')
 92    )
 93    and (
 94      strings.contains(subject.subject, 'Undeliverable:')
 95      or strings.contains(subject.subject, 'Blocked:')
 96      or strings.contains(subject.subject, 'Não é possível entregar:')
 97    )
 98  )
 99  
100  // negate other legitimate MS notifications
101  and not (
102    length(body.links) > 0
103    and all(body.links,
104            .href_url.domain.root_domain in (
105              "aka.ms",
106              "microsoftonline.com",
107              "microsoft.com"
108            )
109            or .href_url.domain.tld == "microsoft"
110    )
111    and headers.auth_summary.dmarc.pass
112  )
113  
114  // negate highly trusted sender domains unless they fail DMARC authentication
115  and (
116    (
117      sender.email.domain.root_domain in $high_trust_sender_root_domains
118      and not headers.auth_summary.dmarc.pass
119    )
120    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
121  )
122  // not a newsletter or advertisement
123  and not any(beta.ml_topic(body.current_thread.text).topics,
124              .name in ("Newsletters and Digests")
125              and .confidence == "high"
126              and (
127                any(body.links,
128                    strings.icontains(.display_text, "unsubscribe")
129                    and (strings.icontains(.href_url.path, "unsubscribe"))
130                )
131              )
132  )  
133
134attack_types:
135  - "Credential Phishing"
136tactics_and_techniques:
137  - "Impersonation: Brand"
138  - "Social engineering"
139detection_methods:
140  - "Content analysis"
141  - "Sender analysis"
142id: "6e2f04e6-b607-5e36-9015-d39c98265579"