Brand impersonation: Cloud services with credential theft intent

 1name: "Brand impersonation: Cloud services with credential theft intent"
 2description: "Detects messages impersonating cloud services that contain high-confidence credential theft language and file sharing topics. The message starts with 'Cloud' or a cloud emoji or Cloud+ text, contains links to external domains not matching the sender's domain, and lacks recipient identification entities."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and (
 8    any([body.current_thread.text, body.html.inner_text],
 9        strings.starts_with(., 'Cloud')
10        or strings.icontains(., "Cloud+ ")
11        or regex.icontains(., '^\x{FEFF}\s*Cloud')
12    )
13    // cloud emoji
14    or regex.contains(body.current_thread.text, '^\x{2601}')
15    or regex.icontains(body.current_thread.text, '^!\s*cloud storage')
16    // address in the body
17    or strings.icontains(body.current_thread.text,
18                         '4563 Cloud Way, Server City, CA'
19    )
20    or any(html.xpath(body.html, '//img/@alt').nodes,
21           regex.icontains(.raw, '^cloud (?:logo|storage)')
22    )
23    or regex.icontains(body.current_thread.text, 'cloud id:\s*#\d+')
24    // body with cloud storage usage "percentage %"
25    or (
26      regex.icontains(body.current_thread.text,
27                      '\bi?cloud\s(?:capacity|storage)\b'
28      )
29      and regex.icontains(body.current_thread.text, '\(?[0-9]{3}%\)?\s+?\b')
30    )
31  )
32  and any(ml.nlu_classifier(body.current_thread.text).intents,
33          .name == 'cred_theft' and .confidence == 'high'
34  )
35  and any(ml.nlu_classifier(body.current_thread.text).topics,
36          .name in (
37            'File Sharing and Cloud Services',
38            'Payment Information',
39            'Financial Communications'
40          )
41          and .confidence != 'low'
42  )
43  // sender domain matches no body domains
44  and length(filter(body.links,
45                    .href_url.scheme != 'mailto'
46                    and .href_url.domain.root_domain is not null
47                    and .href_url.domain.root_domain != 'oracle.com'
48             )
49  ) > 0
50  and (
51    all(filter(body.links,
52               .href_url.scheme != 'mailto'
53               and .href_url.domain.root_domain is not null
54        ),
55        .href_url.domain.root_domain != coalesce(sender.email.domain.root_domain,
56                                                 ""
57        )
58    )
59    or network.whois(sender.email.domain).days_old <= 365
60  )
61  // negate legit cloud companies
62  and not (
63    coalesce(sender.email.domain.root_domain, "") in (
64      "cloud-cme.com",
65      "cloudcounting.online",
66      "cloudhealthtech.com",
67      "cloudpano.com"
68    )
69    // check for SPF or DMARC passed
70    and (headers.auth_summary.spf.pass or headers.auth_summary.dmarc.pass)
71  )
72  // negate highly trusted sender domains unless they fail DMARC authentication
73  and not (
74    sender.email.domain.root_domain in $high_trust_sender_root_domains
75    and coalesce(headers.auth_summary.dmarc.pass, false)
76  )
77  // negate Spark Cloud Attachments
78  and not any(headers.hops,
79              .index == 0
80              and any(.fields,
81                      .name == "X-Readdle-Spark-Cloud-Attachment"
82                      and .value is not null
83              )
84  )
85  and not (
86    sender.email.email == "noreply@icloud.com.cn"
87    and coalesce(headers.auth_summary.dmarc.pass, false)
88  )  
89attack_types:
90  - "Credential Phishing"
91tactics_and_techniques:
92  - "Social engineering"
93detection_methods:
94  - "Content analysis"
95  - "Natural Language Understanding"
96  - "Sender analysis"
97  - "URL analysis"
98id: "5f1395a6-e2ae-5175-ad29-5f35111219fd"