Display name and subject impersonation using recipient SLD (new sender)

The recipient domain's SLD is used in the sender's display name and in the subject to impersonate the organization.

Sublime rule (View on GitHub)

 1name: "Display name and subject impersonation using recipient SLD (new sender)"
 2description: |
 3  The recipient domain's SLD is used in the sender's display name
 4  and in the subject to impersonate the organization.   
 5type: "rule"
 6severity: "medium"
 7source: |
 8  type.inbound
 9  and (
10    // recipient SLD is being impersonated in the subject + display name
11    (
12       // these are usually targeted with just 1 recipient,
13      // but sometimes they CC themselves or have a blank CC
14      length(recipients.to) + length(recipients.cc) + length(recipients.bcc) <= 2
15      and any(recipients.to,
16              // ensure that we're checking the org SLD
17              .email.domain.sld in $org_slds
18              and strings.icontains(subject.subject, .email.domain.sld)
19              and strings.icontains(sender.display_name, .email.domain.sld)
20      )
21    )
22    or (
23      // accounts for BCC'd messages where the recipients are empty
24      // if BCC, sometimes the recipient will be the attacker's email
25      length(recipients.to) + length(recipients.cc) + length(recipients.bcc) <= 2
26      and strings.icontains(subject.subject, mailbox.email.domain.sld)
27      and strings.icontains(sender.display_name, mailbox.email.domain.sld)
28    )
29  )
30
31  and (
32      // at least 1 link or non-image attachment
33      (
34        length(body.links) > 0
35        // these attacks all use compromosed senders, so we look for a domain
36        // that doesn't match the sender's domain to weed out legit messages
37        and any(body.links, .href_url.domain.root_domain != sender.email.domain.root_domain)
38      )
39      or length(filter(attachments, .file_type not in $file_types_images)) > 0
40  )
41
42  and not (
43    strings.contains(sender.display_name, "on behalf of")
44    and sender.email.domain.root_domain == "microsoftonline.com"
45  )
46
47  and all(recipients.to, .email.email != sender.email.email)
48
49  // negate org domain senders, which can often be misconfigured and fail
50  // authentication, causing them to be type.inbound instead of type.internal.
51  // this is fine because we should catch spoofs in other ways.
52  // also, we use root_domain here to account for subdomains used by internal tools that aren't connected to the tenant.
53  // this should also be safe because domains like onmicrosoft[.]com are tracked as FQDNs in $org_domains, so they won't match
54  and sender.email.domain.root_domain not in $org_domains
55
56  // negate highly trusted sender domains unless they fail DMARC authentication
57  and (
58    (
59      sender.email.domain.root_domain in $high_trust_sender_root_domains
60      and (
61        any(distinct(headers.hops, .authentication_results.dmarc is not null),
62            strings.ilike(.authentication_results.dmarc, "*fail")
63        )
64      )
65    )
66    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
67  )
68  and (
69    (
70      not profile.by_sender().solicited
71    )
72    or (
73      profile.by_sender().any_messages_malicious_or_spam
74      and not profile.by_sender().any_false_positives
75    )
76  )
77  and not profile.by_sender().any_false_positives  
78attack_types:
79  - "Credential Phishing"
80tactics_and_techniques:
81  - "Social engineering"
82detection_methods:
83  - "Header analysis"
84  - "Sender analysis"
85id: "cb2b3ed3-268f-5753-9d2b-194d2ee1ed2e"
to-top