Brand impersonation: Microsoft

  1name: "Brand impersonation: Microsoft"
  2description: |
  3    Impersonation of the Microsoft brand.
  4references:
  5  - "https://www.itproportal.com/news/cybercriminals-launch-targeted-phishing-attacks-against-microsoft-365-users/"
  6  - "https://cofense.com/blog/office-365-phishing-variant/"
  7  - "https://www.helpnetsecurity.com/2020/05/04/fake-microsoft-teams-notification/"
  8type: "rule"
  9severity: "high"
 10authors:
 11  - twitter: "amitchell516"
 12source: |
 13  type.inbound
 14  and (
 15    length(body.links) < 30
 16    or sender.email.local_part == "newsletter" and length(body.links) < 5
 17  )
 18  and (
 19    (
 20      strings.ilike(subject.subject, '*Microsoft 365*')
 21      and strings.ilike(subject.subject, '*is expired*')
 22    )
 23    or (
 24      // should catch any instance of the word "expired"
 25      strings.ilike(body.current_thread.text, "*expir*")
 26      and strings.ilike(body.current_thread.text, "*password*")
 27      and strings.ilike(body.current_thread.text, "*microsoft*")
 28    )
 29    or regex.icontains(body.current_thread.text,
 30                       ".*reach you.{0,20}Microsoft Teams",
 31                       "microsoft account\n2fa"
 32    )
 33    or strings.icontains(body.current_thread.text, "microsoft account team")
 34    or strings.ilike(sender.display_name, '*new activity in Teams*')
 35    or strings.icontains(strings.replace_confusables(sender.display_name),
 36                         'microsoft advertising support'
 37    )
 38    or subject.subject =~ 'Offline Message in Teams'
 39    or strings.ilike(subject.subject, '*Teams Sent A Message')
 40    or sender.display_name in~ (
 41      'Microsoft Partner Network',
 42      'Microsoft Advertising',
 43      'Microsoft',
 44      'Microsoft Feedback',
 45      'Microsoft account team',
 46      'Microsoft Support',
 47      'Microsoft 365 Message center',
 48      'Microsoft Azure'
 49    )
 50    or regex.icontains(sender.display_name,
 51                       "[MḾṀṂⱮМḿṁṃᵯⱮ𝐌𝑀][iíìîïīĭĩįıɪɨᵢⁱ𝐢𝑖][cćĉċčçƈȼ𝐜𝑐][rŕŗřȑȓɾᵣⁿʳ𝐫𝑟][oóòôõöøōŏőɵₒᵒº𝐨𝑜][sśŝšșşʂᵴˢˢ𝐬𝑠][oóòôõöøōŏőɵₒᵒº𝐨𝑜][fḟƒᵮᶠ𝐟𝑓][tťțţᵵₜᵗᵗ𝐭𝑡]"
 52    )
 53    or regex.icontains(sender.display_name,
 54                       "[MḾṀṂⱮМḿṁṃᵯⱮ𝐌𝑀][iíìîïīĭĩįıɪɨᵢⁱ𝐢𝑖][rŕŗřȑȓɾᵣⁿʳ𝐫𝑟][cćĉċčçƈȼ𝐜𝑐][oóòôõöøōŏőɵₒᵒº𝐨𝑜][sśŝšșşʂᵴˢˢ𝐬𝑠][oóòôõöøōŏőɵₒᵒº𝐨𝑜][fḟƒᵮᶠ𝐟𝑓][tťțţᵵₜᵗᵗ𝐭𝑡]" // [sic]
 55    )
 56  )
 57  and not (
 58    sender.email.domain.root_domain in~ (
 59      'microsoft.com',
 60      'microsoftstoreemail.com',
 61      'microsoftsupport.com',
 62      'office.com',
 63      'teams-events.com',
 64      'qualtrics-research.com',
 65      'skype.com',
 66      'azureadnotifications.us',
 67      'microsoftonline.us',
 68      'mail.microsoft',
 69      'office365.com',
 70      'microsoftadvertising.com'
 71    )
 72    and headers.auth_summary.dmarc.pass
 73  )
 74  and not (
 75    sender.email.domain.domain in~ (
 76      'microsoft.regsvc.com',
 77      'microsoft.onmicrosoft.com'
 78    )
 79    and headers.auth_summary.dmarc.pass
 80  )
 81  and (
 82    profile.by_sender().prevalence in ("new", "outlier")
 83    or (
 84      profile.by_sender().any_messages_malicious_or_spam
 85      and not profile.by_sender().any_messages_benign
 86    )
 87  )
 88  
 89  // negate legitimate Office 365 bouncebacks
 90  and not (
 91    all(attachments,
 92        .content_type in ("message/delivery-status", "message/rfc822")
 93    )
 94    and (
 95      sender.email.local_part in ('postmaster', 'mailer-daemon')
 96      or strings.starts_with(sender.email.local_part, 'microsoftexchange')
 97    )
 98    and (
 99      strings.contains(subject.subject, 'Undeliverable:')
100      or strings.contains(subject.subject, 'Blocked:')
101      or strings.contains(subject.subject, 'Não é possível entregar:')
102      or strings.contains(subject.subject, 'Nie można dostarczyć:')
103      or strings.contains(subject.subject, 'Non remis :')
104      or strings.contains(subject.subject, 'Teslim edilmez:')
105      or strings.contains(subject.subject, 'No se puede entregar:')
106    )
107  )
108  
109  // negate other legitimate MS notifications
110  and not (
111    length(body.links) > 0
112    and (
113      (
114        all(body.links,
115            .href_url.domain.root_domain in (
116              "aka.ms",
117              "microsoftonline.com",
118              "microsoft.com"
119            )
120            or .href_url.domain.tld == "microsoft"
121        )
122        and headers.auth_summary.dmarc.pass
123      )
124  
125      // microsoft b2b applications invitations - no auth checks
126      or (
127        sender.email.local_part == "invites"
128        and sender.email.domain.root_domain == "onmicrosoft.com"
129        // infra validated message id
130        and strings.icontains(headers.message_id, "pepf")
131      )
132    )
133  )
134  
135  // negate highly trusted sender domains unless they fail DMARC authentication
136  and not (
137    sender.email.domain.root_domain in $high_trust_sender_root_domains
138    and coalesce(headers.auth_summary.dmarc.pass, false)
139  )
140  // not a newsletter or advertisement
141  and not (
142    any(ml.nlu_classifier(body.current_thread.text).topics,
143        .name in ("Newsletters and Digests") and .confidence == "high"
144    )
145    and (
146      any(body.links,
147          strings.icontains(.display_text, "unsubscribe")
148          and (strings.icontains(.href_url.path, "unsubscribe"))
149      )
150    )
151  )  
152
153attack_types:
154  - "Credential Phishing"
155tactics_and_techniques:
156  - "Impersonation: Brand"
157  - "Social engineering"
158detection_methods:
159  - "Content analysis"
160  - "Sender analysis"
161id: "6e2f04e6-b607-5e36-9015-d39c98265579"