Brand impersonation: Sharepoint fake file share
This rule detects messages impersonating a Sharepoint file sharing email where no links point to known Microsoft domains.
Sublime rule (View on GitHub)
1name: "Brand impersonation: Sharepoint fake file share"
2description: |
3 This rule detects messages impersonating a Sharepoint file sharing email where no links point to known Microsoft domains.
4type: "rule"
5severity: "medium"
6source: |
7 type.inbound
8
9 // Sharepoint body content looks like this
10 and strings.contains(body.current_thread.text, "shared a file with you")
11 and strings.icontains(subject.subject, "shared")
12 and any(ml.logo_detect(beta.message_screenshot()).brands, .name == "Microsoft")
13
14 // fake Sharepoint shares are easy to identify if there are any links
15 // that don't point to microsoft[.]com or *.sharepoint[.]com
16 and not all(body.links,
17 .href_url.domain.root_domain in ("microsoft.com", "sharepoint.com")
18 )
19 and sender.email.domain.root_domain not in $org_domains
20 and sender.email.domain.root_domain not in (
21 "bing.com",
22 "microsoft.com",
23 "microsoftonline.com",
24 "microsoftsupport.com",
25 "microsoft365.com",
26 "office.com",
27 "onedrive.com",
28 "sharepointonline.com",
29 "yammer.com",
30 //ignore microsoft privacy statement links
31 "aka.ms"
32 )
33
34 // negate highly trusted sender domains unless they fail DMARC authentication
35 and (
36 (
37 sender.email.domain.root_domain in $high_trust_sender_root_domains
38 and (
39 any(distinct(headers.hops, .authentication_results.dmarc is not null),
40 strings.ilike(.authentication_results.dmarc, "*fail")
41 )
42 )
43 )
44 or sender.email.domain.root_domain not in $high_trust_sender_root_domains
45 )
46 and (
47 (
48 not profile.by_sender().solicited
49 )
50 or (
51 profile.by_sender().any_messages_malicious_or_spam
52 and not profile.by_sender().any_false_positives
53 )
54 )
55 and not profile.by_sender().any_false_positives
56
57attack_types:
58 - "Credential Phishing"
59 - "Malware/Ransomware"
60detection_methods:
61 - "Content analysis"
62 - "Header analysis"
63 - "URL analysis"
64 - "Computer Vision"
65tactics_and_techniques:
66 - "Impersonation: Brand"
67 - "Social engineering"
68id: "ff8b296b-aa0d-5df0-b4d2-0e599b688f6a"