Commonly abused sender TLD with engaging language

 1name: "Commonly abused sender TLD with engaging language"
 2description: |
 3    Message is from a commonly abused sender TLD, contains various suspicious indicators resembling credential theft, and is unsolicited.
 4type: "rule"
 5severity: "medium"
 6source: |
 7  type.inbound
 8
 9  // we don't do a suspicious link check here
10  // because we are seeing abuse of mass marketing tools
11  // like campaign[.]adobe[.]com
12  // once we roll out better support for unfurling those,
13  // we can update this logic
14  and length(body.links) > 0
15
16  // commonly abused sender TLD
17  and strings.ilike(sender.email.domain.tld, "*.jp")
18  and 3 of (
19    // language attempting to engage
20    any(ml.nlu_classifier(body.current_thread.text).entities, .name == "request"),
21
22    // financial request
23    any(ml.nlu_classifier(body.current_thread.text).entities, .name == "financial"),
24
25    // urgency request
26    any(ml.nlu_classifier(body.current_thread.text).entities, .name == "urgency"),
27
28    // known suspicious pattern in the URL path
29    any(body.links, regex.match(.href_url.path, '\/[a-z]{3}\d[a-z]')),
30
31    // suspicious image that's most likely cred_theft
32    any(attachments,
33        .file_type in $file_types_images
34        and any(file.explode(.),
35                any(ml.nlu_classifier(.scan.ocr.raw).intents, .name == "cred_theft")
36                or any(ml.nlu_classifier(.scan.ocr.raw).entities, .name == "financial")
37        )
38    ),
39
40    // recipient's SLD is in the sender's display name
41    any(recipients.to, strings.icontains(sender.display_name, .email.domain.sld) and (.email.domain.valid or strings.icontains(.display_name, "undisclosed"))),
42  
43    // recipient's email address in the subject
44    any(recipients.to, strings.icontains(subject.subject, .email.email) and (.email.domain.valid or strings.icontains(.display_name, "undisclosed"))),
45  )
46
47  and (
48    not profile.by_sender().solicited
49    or (
50      profile.by_sender().any_messages_malicious_or_spam
51      and not profile.by_sender().any_false_positives
52    )
53  )
54
55    // negate highly trusted sender domains unless they fail DMARC authentication
56  and (
57    (
58      sender.email.domain.root_domain in $high_trust_sender_root_domains
59      and not headers.auth_summary.dmarc.pass
60    )
61    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
62  )  
63attack_types:
64  - "Credential Phishing"
65tactics_and_techniques:
66  - "Social engineering"
67detection_methods:
68  - "File analysis"
69  - "Natural Language Understanding"
70  - "Optical Character Recognition"
71  - "Sender analysis"
72  - "URL analysis"
73id: "447386dc-e748-5aca-8da4-a3d15345550c"