Brand impersonation: Microsoft
Impersonation of the Microsoft brand.
Sublime rule (View on GitHub)
1name: "Brand impersonation: Microsoft"
2description: |
3 Impersonation of the Microsoft brand.
4references:
5 - "https://www.itproportal.com/news/cybercriminals-launch-targeted-phishing-attacks-against-microsoft-365-users/"
6 - "https://cofense.com/blog/office-365-phishing-variant/"
7 - "https://www.helpnetsecurity.com/2020/05/04/fake-microsoft-teams-notification/"
8type: "rule"
9severity: "high"
10authors:
11 - twitter: "amitchell516"
12source: |
13 type.inbound
14 and (
15 length(body.links) < 30
16 or sender.email.local_part == "newsletter" and length(body.links) < 5
17 )
18 and (
19 (
20 strings.ilike(subject.subject, '*Microsoft 365*')
21 and strings.ilike(subject.subject, '*is expired*')
22 )
23 or (
24 // should catch any instance of the word "expired"
25 strings.ilike(body.current_thread.text, "*expir*")
26 and strings.ilike(body.current_thread.text, "*password*")
27 and strings.ilike(body.current_thread.text, "*microsoft*")
28 )
29 or regex.icontains(body.current_thread.text,
30 ".*reach you.{0,20}Microsoft Teams",
31 "microsoft account\n2fa"
32 )
33 or strings.icontains(body.current_thread.text, "microsoft account team")
34 or strings.ilike(sender.display_name, '*new activity in Teams*')
35 or strings.icontains(strings.replace_confusables(sender.display_name),
36 'microsoft advertising support'
37 )
38 or subject.subject =~ 'Offline Message in Teams'
39 or strings.ilike(subject.subject, '*Teams Sent A Message')
40 or sender.display_name in~ (
41 'Microsoft Partner Network',
42 'Microsoft Advertising',
43 'Microsoft',
44 'Microsoft Feedback',
45 'Microsoft account team',
46 'Microsoft Support',
47 'Microsoft 365 Message center',
48 'Microsoft Azure'
49 )
50 or regex.icontains(sender.display_name,
51 "[MḾṀṂⱮМḿṁṃᵯⱮ𝐌𝑀][iíìîïīĭĩįıɪɨᵢⁱ𝐢𝑖][cćĉċčçƈȼ𝐜𝑐][rŕŗřȑȓɾᵣⁿʳ𝐫𝑟][oóòôõöøōŏőɵₒᵒº𝐨𝑜][sśŝšșşʂᵴˢˢ𝐬𝑠][oóòôõöøōŏőɵₒᵒº𝐨𝑜][fḟƒᵮᶠ𝐟𝑓][tťțţᵵₜᵗᵗ𝐭𝑡]"
52 )
53 or regex.icontains(sender.display_name,
54 "[MḾṀṂⱮМḿṁṃᵯⱮ𝐌𝑀][iíìîïīĭĩįıɪɨᵢⁱ𝐢𝑖][rŕŗřȑȓɾᵣⁿʳ𝐫𝑟][cćĉċčçƈȼ𝐜𝑐][oóòôõöøōŏőɵₒᵒº𝐨𝑜][sśŝšșşʂᵴˢˢ𝐬𝑠][oóòôõöøōŏőɵₒᵒº𝐨𝑜][fḟƒᵮᶠ𝐟𝑓][tťțţᵵₜᵗᵗ𝐭𝑡]" // [sic]
55 )
56 or any(attachments,
57 .file_extension == "pdf"
58 and beta.parse_exif(.).page_count == 1
59 and any(ml.logo_detect(.).brands, .name == "Microsoft")
60 and any(file.explode(.),
61 regex.icontains(.scan.ocr.raw,
62 '[©@]\s*(?:\d+)?\s*Microsoft',
63 'message key-\d'
64 )
65 )
66 )
67 )
68 and not (
69 sender.email.domain.root_domain in~ (
70 'microsoft.com',
71 'microsoftstoreemail.com',
72 'microsoftsupport.com',
73 'office.com',
74 'teams-events.com',
75 'qualtrics-research.com',
76 'skype.com',
77 'azureadnotifications.us',
78 'microsoftonline.us',
79 'mail.microsoft',
80 'office365.com',
81 'microsoftadvertising.com'
82 )
83 and headers.auth_summary.dmarc.pass
84 )
85 and not (
86 sender.email.domain.domain in~ (
87 'microsoft.regsvc.com',
88 'microsoft.onmicrosoft.com'
89 )
90 and headers.auth_summary.dmarc.pass
91 )
92 and (
93 profile.by_sender().prevalence in ("new", "outlier")
94 or (
95 profile.by_sender().any_messages_malicious_or_spam
96 and not profile.by_sender().any_messages_benign
97 )
98 )
99
100 // negate legitimate Office 365 bouncebacks
101 and not (
102 all(attachments,
103 .content_type in ("message/delivery-status", "message/rfc822")
104 )
105 and (
106 sender.email.local_part in ('postmaster', 'mailer-daemon')
107 or strings.starts_with(sender.email.local_part, 'microsoftexchange')
108 )
109 and (
110 strings.contains(subject.subject, 'Undeliverable:')
111 or strings.contains(subject.subject, 'Blocked:')
112 or strings.contains(subject.subject, 'Não é possível entregar:')
113 or strings.contains(subject.subject, 'Nie można dostarczyć:')
114 or strings.contains(subject.subject, 'Non remis :')
115 or strings.contains(subject.subject, 'Teslim edilmez:')
116 or strings.contains(subject.subject, 'No se puede entregar:')
117 )
118 )
119
120 // negate other legitimate MS notifications
121 and not (
122 length(body.links) > 0
123 and (
124 (
125 all(body.links,
126 .href_url.domain.root_domain in (
127 "aka.ms",
128 "microsoftonline.com",
129 "microsoft.com"
130 )
131 or .href_url.domain.tld == "microsoft"
132 )
133 and headers.auth_summary.dmarc.pass
134 )
135
136 // microsoft b2b applications invitations - no auth checks
137 or (
138 sender.email.local_part == "invites"
139 and sender.email.domain.root_domain == "onmicrosoft.com"
140 // infra validated message id
141 and strings.icontains(headers.message_id, "pepf")
142 )
143 )
144 )
145
146 // negate highly trusted sender domains unless they fail DMARC authentication
147 and not (
148 sender.email.domain.root_domain in $high_trust_sender_root_domains
149 and coalesce(headers.auth_summary.dmarc.pass, false)
150 )
151 // not a newsletter or advertisement
152 and not (
153 any(ml.nlu_classifier(body.current_thread.text).topics,
154 .name in ("Newsletters and Digests") and .confidence == "high"
155 )
156 and (
157 any(body.links,
158 strings.icontains(.display_text, "unsubscribe")
159 and (strings.icontains(.href_url.path, "unsubscribe"))
160 )
161 )
162 )
163
164attack_types:
165 - "Credential Phishing"
166tactics_and_techniques:
167 - "Impersonation: Brand"
168 - "Social engineering"
169detection_methods:
170 - "Content analysis"
171 - "Sender analysis"
172id: "6e2f04e6-b607-5e36-9015-d39c98265579"