Link: Adobe Share with Suspicious Indicators

 1name: "Link: Adobe Share with Suspicious Indicators"
 2description: "The detection rule matches messages sent from Adobe and contain indicators of malicious use. The indicators include observed call to action phrases, suspicious filenames, all capital filenames, the sender's display name (as determined by NLU) included in the comment section, or Microsoft branding on the shared link."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  // from Adobe Actual
 8  and strings.icontains(sender.display_name, 'via Adobe')
 9  and sender.email.email == 'message@adobe.com'
10  and headers.auth_summary.dmarc.pass
11  // contains a link to open or review a share
12  and any(body.links, .display_text =~ "open" or .display_text =~ "review")
13  
14  // not sent from a Adobe User within the org's domains
15  and not any($org_domains,
16              strings.icontains(sender.display_name,
17                                strings.concat("@", ., ' via Adobe')
18              )
19              // sometimes the email is in parentheses
20              or strings.icontains(sender.display_name,
21                                strings.concat("@", ., ') via Adobe')
22              )
23  )
24  and (
25    // the comments observed wording, using the html to make sure it's in the actor controlled section of the message
26    regex.icontains(body.html.raw,
27                    '<tr>[\r\n]+<td style="color:#505050; font-family:adobe-clean, Helvetica Neue, Helvetica, Verdana, Arial, sans-serif; font-size:18px; line-height:26px; padding-top:20px;">[\r\n]+<xmp style="font-family:adobe-clean, Helvetica Neue, Helvetica, Verdana, Arial, sans-serif; font-size:18px; line-height:26px overflow-x:auto; white-space:pre-wrap; white-space:-moz-pre-wrap; white-space:-pre-wrap; white-space:-o-pre-wrap; word-wrap:break-word;">Please review the attached below for your reference,'
28    )
29    // the filename shared
30    or regex.icontains(body.html.raw,
31                       // , ends in some random numbers
32                       '<td style="color:#000000; font-family:adobe-clean, Helvetica Neue, Helvetica, Verdana, Arial, sans-serif; font-size:24px; line-height:26px; padding-top:65px;">[\r\n]+<strong>[^\<]+<\/strong> (invited you to review|has shared) <strong>[^\<]+([]|[[:punct:]\s](?:AP|AR)?\d+[a-z]?)<\/strong></td>[\r\n]+</tr>'
33    )
34    // contains all capital letters, allowing for numbers
35    or regex.contains(body.html.raw,
36                      '<td style="color:#000000; font-family:adobe-clean, Helvetica Neue, Helvetica, Verdana, Arial, sans-serif; font-size:24px; line-height:26px; padding-top:65px;">[\r\n]+<strong>[^\<]+<\/strong> (invited you to review|has shared) <strong>(?:[A-Z0-9_\-\s]+)<\/strong></td>[\r\n]+</tr>',
37    )
38    // contains commonly observed themes used by actors
39    or regex.icontains(body.html.raw,
40                       // , ends in some random numbers
41                       '<td style=\"color:#000000; font-family:adobe-clean, Helvetica Neue, Helvetica, Verdana, Arial, sans-serif; font-size:24px; line-height:26px; padding-top:65px;\">[\r\n]+<strong>[^\<]+<\/strong> invited you to review <strong>[^\<]*(Invoice|Payment|Agreement|Settlements|Overdue|Confidential|Transaction)[^\<]*<\/strong></td>[\r\n]+</tr>')
42    // the NLU detected "sender" is included within the body wrapped with new lines indicating it's a "signature"
43    or any(filter(ml.nlu_classifier(body.current_thread.text).entities,
44                  .name == "sender" and .text not in ('Customer Support', 'SHARED ON')
45                  // in some cases the filename is detected as the sender
46                  // we can filter out this case when the detected "sender"
47                  // text is the file shared
48                  and not strings.icontains(body.current_thread.text,
49                                            strings.concat("invited you to edit\n",
50                                                           .text,
51                                                           "\nOpen"
52                                            )
53                  )
54           ),
55           strings.icontains(body.current_thread.text,
56                             strings.concat("\n", .text, "\n")
57           )
58    )
59    // finally we'll hit the actual page and see if we can get some enrichment functions to give up some gold
60    or any(filter(body.links, .display_text =~ "open" or .display_text =~ "review"),
61      // detected as Microsoft
62      any(ml.logo_detect(ml.link_analysis(., mode="aggressive").screenshot).brands, .name in ("Microsoft") and .confidence == "high")
63    )
64  )  
65attack_types:
66  - "Credential Phishing"
67tactics_and_techniques:
68  - "Evasion"
69  - "Free file host"
70detection_methods:
71  - "Content analysis"
72  - "URL screenshot"
73  - "Sender analysis"
74  - "Natural Language Understanding"
75  - "URL analysis"
76id: "b33cae80-adbc-59b6-b732-21e739c3cb96"