Brand impersonation: Cloud services with credential theft intent

 1name: "Brand impersonation: Cloud services with credential theft intent"
 2description: "Detects messages impersonating cloud services that contain high-confidence credential theft language and file sharing topics. The message starts with 'Cloud' or a cloud emoji or Cloud+ text, contains links to external domains not matching the sender's domain, and lacks recipient identification entities."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    any([body.current_thread.text, body.html.inner_text],
 9        strings.starts_with(., 'Cloud')
10        or strings.icontains(., "Cloud+ ")
11        or regex.icontains(., '^\x{FEFF}\s*Cloud')
12    )
13    // cloud emoji
14    or regex.contains(body.current_thread.text, '^\x{2601}')
15    or regex.icontains(body.current_thread.text, '^!\s*cloud storage')
16    // address in the body
17    or strings.icontains(body.current_thread.text,
18                         '4563 Cloud Way, Server City, CA'
19    )
20    or any(html.xpath(body.html, '//img/@alt').nodes,
21           regex.icontains(.raw, '^cloud (?:logo|storage)')
22    )
23    or regex.icontains(body.current_thread.text, 'cloud id:\s*#\d+')
24    // body with cloud storage usage "percentage %"
25    or (
26      regex.icontains(body.current_thread.text,
27                      '\bi?cloud\s(?:capacity|storage)\b'
28      )
29      and regex.icontains(body.current_thread.text, '\(?[0-9]{3}%\)?\s+?\b')
30    )
31  )
32  and any(ml.nlu_classifier(body.current_thread.text).intents,
33          .name == 'cred_theft' and .confidence == 'high'
34  )
35  and any(ml.nlu_classifier(body.current_thread.text).topics,
36          .name in (
37            'File Sharing and Cloud Services',
38            'Payment Information',
39            'Financial Communications'
40          )
41          and .confidence != 'low'
42  )
43  // sender domain matches no body domains
44  and length(filter(body.links,
45                    .href_url.scheme != 'mailto'
46                    and .href_url.domain.root_domain is not null
47                    and .href_url.domain.root_domain != 'oracle.com'
48             )
49  ) > 0
50  and all(filter(body.links,
51                 .href_url.scheme != 'mailto'
52                 and .href_url.domain.root_domain is not null
53          ),
54          .href_url.domain.root_domain != coalesce(sender.email.domain.root_domain,
55                                                   ""
56          )
57  )
58  // negate legit cloud companies
59  and not (
60    coalesce(sender.email.domain.root_domain, "") in (
61      "cloud-cme.com",
62      "cloudcounting.online",
63      "cloudhealthtech.com",
64      "cloudpano.com"
65    )
66    // check for SPF or DMARC passed
67    and (headers.auth_summary.spf.pass or headers.auth_summary.dmarc.pass)
68  )
69  // negate highly trusted sender domains unless they fail DMARC authentication
70  and not (
71    sender.email.domain.root_domain in $high_trust_sender_root_domains
72    and coalesce(headers.auth_summary.dmarc.pass, false)
73  )
74  // negate Spark Cloud Attachments
75  and not any(headers.hops,
76              .index == 0
77              and any(.fields,
78                      .name == "X-Readdle-Spark-Cloud-Attachment"
79                      and .value is not null
80              )
81  )
82  and not (
83    sender.email.email == "noreply@icloud.com.cn"
84    and coalesce(headers.auth_summary.dmarc.pass, false)
85  )  
86attack_types:
87  - "Credential Phishing"
88tactics_and_techniques:
89  - "Social engineering"
90detection_methods:
91  - "Content analysis"
92  - "Natural Language Understanding"
93  - "Sender analysis"
94  - "URL analysis"
95id: "5f1395a6-e2ae-5175-ad29-5f35111219fd"