Brand impersonation: Microsoft
Impersonation of the Microsoft brand.
Sublime rule (View on GitHub)
1name: "Brand impersonation: Microsoft"
2description: |
3 Impersonation of the Microsoft brand.
4references:
5 - "https://www.itproportal.com/news/cybercriminals-launch-targeted-phishing-attacks-against-microsoft-365-users/"
6 - "https://cofense.com/blog/office-365-phishing-variant/"
7 - "https://www.helpnetsecurity.com/2020/05/04/fake-microsoft-teams-notification/"
8type: "rule"
9severity: "high"
10authors:
11 - twitter: "amitchell516"
12source: |
13 type.inbound
14 and (
15 length(body.links) < 30
16 or sender.email.local_part == "newsletter" and length(body.links) < 5
17 )
18 and (
19 (
20 strings.ilike(subject.subject, '*Microsoft 365*')
21 and strings.ilike(subject.subject, '*is expired*')
22 )
23 or (
24 // should catch any instance of the word "expired"
25 strings.ilike(body.current_thread.text, "*expir*")
26 and strings.ilike(body.current_thread.text, "*password*")
27 and strings.ilike(body.current_thread.text, "*microsoft*")
28 )
29 or regex.icontains(body.current_thread.text,
30 ".*reach you.{0,20}Microsoft Teams",
31 "microsoft account\n2fa"
32 )
33 or strings.icontains(body.current_thread.text, "microsoft account team")
34 or strings.ilike(sender.display_name, '*new activity in Teams*')
35 or strings.icontains(strings.replace_confusables(sender.display_name),
36 'microsoft advertising support'
37 )
38 or subject.subject =~ 'Offline Message in Teams'
39 or strings.ilike(subject.subject, '*Teams Sent A Message')
40 or sender.display_name in~ (
41 'Microsoft Partner Network',
42 'Microsoft Advertising',
43 'Microsoft',
44 'Microsoft Feedback',
45 'Microsoft account team',
46 'Microsoft Support',
47 'Microsoft 365 Message center',
48 'Microsoft Azure'
49 )
50 or regex.icontains(sender.display_name,
51 "[MḾṀṂⱮМḿṁṃᵯⱮ𝐌𝑀][iíìîïīĭĩįıɪɨᵢⁱ𝐢𝑖][cćĉċčçƈȼ𝐜𝑐][rŕŗřȑȓɾᵣⁿʳ𝐫𝑟][oóòôõöøōŏőɵₒᵒº𝐨𝑜][sśŝšșşʂᵴˢˢ𝐬𝑠][oóòôõöøōŏőɵₒᵒº𝐨𝑜][fḟƒᵮᶠ𝐟𝑓][tťțţᵵₜᵗᵗ𝐭𝑡]"
52 )
53 or regex.icontains(sender.display_name,
54 "[MḾṀṂⱮМḿṁṃᵯⱮ𝐌𝑀][iíìîïīĭĩįıɪɨᵢⁱ𝐢𝑖][rŕŗřȑȓɾᵣⁿʳ𝐫𝑟][cćĉċčçƈȼ𝐜𝑐][oóòôõöøōŏőɵₒᵒº𝐨𝑜][sśŝšșşʂᵴˢˢ𝐬𝑠][oóòôõöøōŏőɵₒᵒº𝐨𝑜][fḟƒᵮᶠ𝐟𝑓][tťțţᵵₜᵗᵗ𝐭𝑡]" // [sic]
55 )
56 or any(attachments,
57 .file_extension == "pdf"
58 and beta.parse_exif(.).page_count == 1
59 and any(ml.logo_detect(.).brands, .name == "Microsoft")
60 and any(file.explode(.),
61 regex.icontains(.scan.ocr.raw,
62 '[©@]\s*(?:\d+)?\s*Microsoft',
63 'message key-\d'
64 )
65 or (
66 any(ml.nlu_classifier(.scan.ocr.raw).intents,
67 .name == "cred_theft" and .confidence != "low"
68 )
69 and any(ml.nlu_classifier(.scan.ocr.raw).topics,
70 .name in (
71 "File Sharing and Cloud Services",
72 "Payment Information"
73 )
74 )
75 )
76 )
77 )
78 )
79 and not (
80 sender.email.domain.root_domain in~ (
81 'microsoft.com',
82 'microsoftstoreemail.com',
83 'microsoftsupport.com',
84 'office.com',
85 'teams-events.com',
86 'qualtrics-research.com',
87 'skype.com',
88 'azureadnotifications.us',
89 'microsoftonline.us',
90 'mail.microsoft',
91 'office365.com',
92 'microsoftadvertising.com'
93 )
94 and headers.auth_summary.dmarc.pass
95 )
96 and not (
97 sender.email.domain.domain in~ (
98 'microsoft.regsvc.com',
99 'microsoft.onmicrosoft.com'
100 )
101 and headers.auth_summary.dmarc.pass
102 )
103 and (
104 profile.by_sender().prevalence in ("new", "outlier")
105 or (
106 profile.by_sender().any_messages_malicious_or_spam
107 and not profile.by_sender().any_messages_benign
108 )
109 )
110
111 // negate legitimate Office 365 bouncebacks
112 and not (
113 all(attachments,
114 .content_type in ("message/delivery-status", "message/rfc822")
115 )
116 and (
117 sender.email.local_part in ('postmaster', 'mailer-daemon')
118 or strings.starts_with(sender.email.local_part, 'microsoftexchange')
119 )
120 and (
121 strings.contains(subject.subject, 'Undeliverable:')
122 or strings.contains(subject.subject, 'Blocked:')
123 or strings.contains(subject.subject, 'Não é possível entregar:')
124 or strings.contains(subject.subject, 'Nie można dostarczyć:')
125 or strings.contains(subject.subject, 'Non remis :')
126 or strings.contains(subject.subject, 'Teslim edilmez:')
127 or strings.contains(subject.subject, 'No se puede entregar:')
128 )
129 )
130
131 // negate other legitimate MS notifications
132 and not (
133 length(body.links) > 0
134 and (
135 (
136 all(body.links,
137 .href_url.domain.root_domain in (
138 "aka.ms",
139 "microsoftonline.com",
140 "microsoft.com"
141 )
142 or .href_url.domain.tld == "microsoft"
143 )
144 and headers.auth_summary.dmarc.pass
145 )
146
147 // microsoft b2b applications invitations - no auth checks
148 or (
149 sender.email.local_part == "invites"
150 and sender.email.domain.root_domain == "onmicrosoft.com"
151 // infra validated message id
152 and strings.icontains(headers.message_id, "pepf")
153 )
154 )
155 )
156
157 // negate highly trusted sender domains unless they fail DMARC authentication
158 and not (
159 sender.email.domain.root_domain in $high_trust_sender_root_domains
160 and coalesce(headers.auth_summary.dmarc.pass, false)
161 )
162 // not a newsletter or advertisement
163 and not (
164 any(ml.nlu_classifier(body.current_thread.text).topics,
165 .name in ("Newsletters and Digests") and .confidence == "high"
166 )
167 and (
168 any(body.links,
169 strings.icontains(.display_text, "unsubscribe")
170 and (strings.icontains(.href_url.path, "unsubscribe"))
171 )
172 )
173 )
174
175attack_types:
176 - "Credential Phishing"
177tactics_and_techniques:
178 - "Impersonation: Brand"
179 - "Social engineering"
180detection_methods:
181 - "Content analysis"
182 - "Sender analysis"
183id: "6e2f04e6-b607-5e36-9015-d39c98265579"