Link: Executable file download with suspicious message content

 1name: "Link: Executable file download with suspicious message content"
 2description: "Detects inbound messages containing links to executable files combined with high-confidence security, financial, or credential theft content indicators, while excluding legitimate trusted domains with proper DMARC authentication."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and length(body.links) < 10
 8  and any(body.links,
 9          any($file_extensions_executables,
10              strings.iends_with(..href_url.url, strings.concat(".", .))
11              // the display text is not going to reveal the executable extension
12              and not strings.iends_with(..display_text, strings.concat(".", .))
13          )
14          and .href_url.path is not null
15          // filter out some executables
16          and not any(["com", "action", "js", "app"],
17                      strings.iends_with(..href_url.url, .)
18          )
19          // .app links from Google Play
20          and not .href_url.domain.domain == "play.google.com"
21          and not .href_url.domain.root_domain in $high_trust_sender_root_domains
22  )
23  and not (
24    (subject.is_reply or subject.is_forward)
25    and length(body.previous_threads) > 0
26    and (length(headers.references) > 0 or headers.in_reply_to is not null)
27  )
28  and 2 of (
29    any(ml.nlu_classifier(body.current_thread.text).topics,
30        .name in ("Security and Authentication", "Financial Communications")
31        and .confidence == "high"
32    ),
33    any(ml.nlu_classifier(body.current_thread.text).intents,
34        .name == "cred_theft" and .confidence == "high"
35    ),
36    sender.email.domain.tld in $suspicious_tlds
37  )
38  
39  // negate highly trusted sender domains unless they fail DMARC authentication
40  and not (
41    sender.email.domain.root_domain in $high_trust_sender_root_domains
42    and coalesce(headers.auth_summary.dmarc.pass, false)
43  )  
44
45attack_types:
46  - "Credential Phishing"
47  - "Malware/Ransomware"
48tactics_and_techniques:
49  - "Evasion"
50  - "Social engineering"
51detection_methods:
52  - "Content analysis"
53  - "Natural Language Understanding"
54  - "Sender analysis"
55  - "URL analysis"
56  - "Header analysis"
57id: "ce9a4926-6e38-5af4-8740-4a141e84958b"