Commonly abused sender TLD with engaging language

 1name: "Commonly abused sender TLD with engaging language"
 2description: |
 3    Message is from a commonly abused sender TLD, contains various suspicious indicators resembling credential theft, and is unsolicited.
 4type: "rule"
 5severity: "medium"
 6source: |
 7  type.inbound
 8
 9  // we don't do a suspicious link check here
10  // because we are seeing abuse of mass marketing tools
11  // like campaign[.]adobe[.]com
12  // once we roll out better support for unfurling those,
13  // we can update this logic
14  and length(body.links) > 0
15
16  // commonly abused sender TLD
17  and strings.ilike(sender.email.domain.tld, "*.jp")
18  and 3 of (
19    // language attempting to engage
20    any(ml.nlu_classifier(body.html.display_text).entities, .name == "request"),
21
22    // financial request
23    any(ml.nlu_classifier(body.html.display_text).entities, .name == "financial"),
24
25    // urgency request
26    any(ml.nlu_classifier(body.html.display_text).entities, .name == "urgency"),
27
28    // known suspicious pattern in the URL path
29    any(body.links, regex.match(.href_url.path, '\/[a-z]{3}\d[a-z]')),
30
31    // suspicious image that's most likely cred_theft
32    any(attachments,
33        .file_type in $file_types_images
34        and any(file.explode(.),
35                any(ml.nlu_classifier(.scan.ocr.raw).intents, .name == "cred_theft")
36                or any(ml.nlu_classifier(.scan.ocr.raw).entities, .name == "financial")
37        )
38    ),
39
40    // recipient's SLD is in the sender's display name
41    any(recipients.to, strings.icontains(sender.display_name, .email.domain.sld)),
42
43    // recipient's email address in the subject
44    any(recipients.to, strings.icontains(subject.subject, .email.email)),
45  )
46
47  // unsolicited
48  and (
49    (
50      sender.email.domain.root_domain in $free_email_providers
51      and sender.email.email not in $recipient_emails
52    )
53    or (
54      sender.email.domain.root_domain not in $free_email_providers
55      and sender.email.domain.domain not in $recipient_domains
56    )
57  )  
58attack_types:
59  - "Credential Phishing"
60tactics_and_techniques:
61  - "Social engineering"
62detection_methods:
63  - "File analysis"
64  - "Natural Language Understanding"
65  - "Optical Character Recognition"
66  - "Sender analysis"
67  - "URL analysis"
68id: "447386dc-e748-5aca-8da4-a3d15345550c"