Brand impersonation: Microsoft

Impersonation of the Microsoft brand.

Sublime rule (View on GitHub)

  1name: "Brand impersonation: Microsoft"
  2description: |
  3    Impersonation of the Microsoft brand.
  4references:
  5  - "https://www.itproportal.com/news/cybercriminals-launch-targeted-phishing-attacks-against-microsoft-365-users/"
  6  - "https://cofense.com/blog/office-365-phishing-variant/"
  7  - "https://www.helpnetsecurity.com/2020/05/04/fake-microsoft-teams-notification/"
  8type: "rule"
  9severity: "high"
 10authors:
 11  - twitter: "amitchell516"
 12source: |
 13  type.inbound
 14  and (
 15    length(body.links) < 30
 16    or sender.email.local_part == "newsletter" and length(body.links) < 5
 17  )
 18  and (
 19    (
 20      strings.ilike(subject.subject, '*Microsoft 365*')
 21      and strings.ilike(subject.subject, '*is expired*')
 22    )
 23    or (
 24      // should catch any instance of the word "expired"
 25      strings.ilike(body.current_thread.text, "*expir*")
 26      and strings.ilike(body.current_thread.text, "*password*")
 27      and strings.ilike(body.current_thread.text, "*microsoft*")
 28    )
 29    or regex.icontains(body.current_thread.text,
 30                       ".*reach you.{0,20}Microsoft Teams",
 31                       "microsoft account\n2fa"
 32    )
 33    or strings.icontains(body.current_thread.text, "microsoft account team")
 34    or strings.ilike(sender.display_name, '*new activity in Teams*')
 35    or strings.icontains(strings.replace_confusables(sender.display_name),
 36                         'microsoft advertising support'
 37    )
 38    or subject.subject =~ 'Offline Message in Teams'
 39    or strings.ilike(subject.subject, '*Teams Sent A Message')
 40    or sender.display_name in~ (
 41      'Microsoft Partner Network',
 42      'Microsoft Advertising',
 43      'Microsoft',
 44      'Microsoft Feedback',
 45      'Microsoft account team',
 46      'Microsoft Support',
 47      'Microsoft 365 Message center',
 48      'Microsoft Azure'
 49    )
 50    or regex.icontains(sender.display_name,
 51                       "[MḾṀṂⱮМḿṁṃᵯⱮ𝐌𝑀][iíìîïīĭĩįıɪɨᵢⁱ𝐢𝑖][cćĉċčçƈȼ𝐜𝑐][rŕŗřȑȓɾᵣⁿʳ𝐫𝑟][oóòôõöøōŏőɵₒᵒº𝐨𝑜][sśŝšșşʂᵴˢˢ𝐬𝑠][oóòôõöøōŏőɵₒᵒº𝐨𝑜][fḟƒᵮᶠ𝐟𝑓][tťțţᵵₜᵗᵗ𝐭𝑡]"
 52    )
 53    or regex.icontains(sender.display_name,
 54                       "[MḾṀṂⱮМḿṁṃᵯⱮ𝐌𝑀][iíìîïīĭĩįıɪɨᵢⁱ𝐢𝑖][rŕŗřȑȓɾᵣⁿʳ𝐫𝑟][cćĉċčçƈȼ𝐜𝑐][oóòôõöøōŏőɵₒᵒº𝐨𝑜][sśŝšșşʂᵴˢˢ𝐬𝑠][oóòôõöøōŏőɵₒᵒº𝐨𝑜][fḟƒᵮᶠ𝐟𝑓][tťțţᵵₜᵗᵗ𝐭𝑡]" // [sic]
 55    )
 56    or any(attachments,
 57           .file_extension == "pdf"
 58           and beta.parse_exif(.).page_count == 1
 59           and any(ml.logo_detect(.).brands, .name == "Microsoft")
 60           and any(file.explode(.),
 61                   regex.icontains(.scan.ocr.raw,
 62                                   '[©@]\s*(?:\d+)?\s*Microsoft',
 63                                   'message key-\d'
 64                   )
 65           )
 66    )
 67  )
 68  and not (
 69    sender.email.domain.root_domain in~ (
 70      'microsoft.com',
 71      'microsoftstoreemail.com',
 72      'microsoftsupport.com',
 73      'office.com',
 74      'teams-events.com',
 75      'qualtrics-research.com',
 76      'skype.com',
 77      'azureadnotifications.us',
 78      'microsoftonline.us',
 79      'mail.microsoft',
 80      'office365.com',
 81      'microsoftadvertising.com'
 82    )
 83    and headers.auth_summary.dmarc.pass
 84  )
 85  and not (
 86    sender.email.domain.domain in~ (
 87      'microsoft.regsvc.com',
 88      'microsoft.onmicrosoft.com'
 89    )
 90    and headers.auth_summary.dmarc.pass
 91  )
 92  and (
 93    profile.by_sender().prevalence in ("new", "outlier")
 94    or (
 95      profile.by_sender().any_messages_malicious_or_spam
 96      and not profile.by_sender().any_messages_benign
 97    )
 98  )
 99  
100  // negate legitimate Office 365 bouncebacks
101  and not (
102    all(attachments,
103        .content_type in ("message/delivery-status", "message/rfc822")
104    )
105    and (
106      sender.email.local_part in ('postmaster', 'mailer-daemon')
107      or strings.starts_with(sender.email.local_part, 'microsoftexchange')
108    )
109    and (
110      strings.contains(subject.subject, 'Undeliverable:')
111      or strings.contains(subject.subject, 'Blocked:')
112      or strings.contains(subject.subject, 'Não é possível entregar:')
113      or strings.contains(subject.subject, 'Nie można dostarczyć:')
114      or strings.contains(subject.subject, 'Non remis :')
115      or strings.contains(subject.subject, 'Teslim edilmez:')
116      or strings.contains(subject.subject, 'No se puede entregar:')
117    )
118  )
119  
120  // negate other legitimate MS notifications
121  and not (
122    length(body.links) > 0
123    and (
124      (
125        all(body.links,
126            .href_url.domain.root_domain in (
127              "aka.ms",
128              "microsoftonline.com",
129              "microsoft.com"
130            )
131            or .href_url.domain.tld == "microsoft"
132        )
133        and headers.auth_summary.dmarc.pass
134      )
135  
136      // microsoft b2b applications invitations - no auth checks
137      or (
138        sender.email.local_part == "invites"
139        and sender.email.domain.root_domain == "onmicrosoft.com"
140        // infra validated message id
141        and strings.icontains(headers.message_id, "pepf")
142      )
143    )
144  )
145  
146  // negate highly trusted sender domains unless they fail DMARC authentication
147  and not (
148    sender.email.domain.root_domain in $high_trust_sender_root_domains
149    and coalesce(headers.auth_summary.dmarc.pass, false)
150  )
151  // not a newsletter or advertisement
152  and not (
153    any(ml.nlu_classifier(body.current_thread.text).topics,
154        .name in ("Newsletters and Digests") and .confidence == "high"
155    )
156    and (
157      any(body.links,
158          strings.icontains(.display_text, "unsubscribe")
159          and (strings.icontains(.href_url.path, "unsubscribe"))
160      )
161    )
162  )  
163
164attack_types:
165  - "Credential Phishing"
166tactics_and_techniques:
167  - "Impersonation: Brand"
168  - "Social engineering"
169detection_methods:
170  - "Content analysis"
171  - "Sender analysis"
172id: "6e2f04e6-b607-5e36-9015-d39c98265579"
to-top