Brand impersonation: Sharepoint fake file share

 1name: "Brand impersonation: Sharepoint fake file share"
 2description: |
 3    This rule detects messages impersonating a Sharepoint file sharing email where no links point to known Microsoft domains.
 4type: "rule"
 5severity: "medium"
 6source: |
 7  type.inbound
 8  
 9  // Sharepoint body content looks like this
10  and strings.like(body.current_thread.text, "*shared a file with you*", "*shared with you*", "*invited you to access a file*")
11  and strings.icontains(subject.subject, "shared")
12  and any(ml.logo_detect(beta.message_screenshot()).brands, .name == "Microsoft")
13  
14  // fake Sharepoint shares are easy to identify if there are any links
15  // that don't point to microsoft[.]com or *.sharepoint[.]com
16  and not all(body.links,
17              .href_url.domain.root_domain in ("aka.ms", "microsoft.com", "sharepoint.com")
18  )
19  and sender.email.domain.root_domain not in $org_domains
20  and sender.email.domain.root_domain not in (
21    "bing.com",
22    "microsoft.com",
23    "microsoftonline.com",
24    "microsoftsupport.com",
25    "microsoft365.com",
26    "office.com",
27    "onedrive.com",
28    "sharepointonline.com",
29    "yammer.com",
30    //ignore microsoft privacy statement links
31    "aka.ms"
32  )
33  
34  // negate highly trusted sender domains unless they fail DMARC authentication
35  and (
36    (
37      sender.email.domain.root_domain in $high_trust_sender_root_domains
38      and not headers.auth_summary.dmarc.pass
39    )
40    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
41  )
42  and (
43    (
44      not profile.by_sender().solicited
45    )
46    or (
47      profile.by_sender().any_messages_malicious_or_spam
48      and not profile.by_sender().any_false_positives
49    )
50  )
51  and not profile.by_sender().any_false_positives  
52
53attack_types:
54  - "Credential Phishing"
55  - "Malware/Ransomware"
56detection_methods:
57  - "Content analysis"
58  - "Header analysis"
59  - "URL analysis"
60  - "Computer Vision"
61tactics_and_techniques:
62  - "Impersonation: Brand"
63  - "Social engineering"
64id: "ff8b296b-aa0d-5df0-b4d2-0e599b688f6a"