Credential phishing: Fake storage alerts (unsolicited)

  1name: "Credential phishing: Fake storage alerts (unsolicited)"
  2description: "This rule targets credential phishing attempts disguised as storage space alerts, activating for inbound emails with specific storage-related keywords and evaluating sender trustworthiness and history."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  and (
  8    (
  9      0 < length(body.links) < 8
 10      and any([subject.subject, sender.display_name],
 11              regex.icontains(., "(?:storage|mailbox)")
 12      )
 13    )
 14    or (
 15      //
 16      // This rule makes use of a beta feature and is subject to change without notice
 17      // using the beta feature in custom rules is not suggested until it has been formally released
 18      //
 19      any(ml.nlu_classifier(beta.ocr(file.message_screenshot()).text).intents,
 20          .name == "cred_theft" and .confidence == "high"
 21      )
 22      and regex.icontains(beta.ocr(file.message_screenshot()).text,
 23                          "storage.{0,50}full",
 24                          "free.{0,50}upgrade",
 25                          "storage.{0,50}details",
 26                          "storage.{0,50}quot",
 27                          "email.{0,50}storage",
 28                          "total.{0,50}storage",
 29                          "storage.{0,50}limit",
 30                          "cloud.{0,50}update payment",
 31      )
 32      and not strings.ilike(beta.ocr(file.message_screenshot()).text,
 33                            "*free plan*"
 34      )
 35    )
 36    or (
 37      any(body.links,
 38          // fingerprints of a hyperlinked image
 39          .display_text is null
 40          and .display_url.url is null
 41          and (
 42            .href_url.domain.root_domain in $free_file_hosts
 43            or .href_url.domain.root_domain == "beehiiv.com"
 44          )
 45      )
 46      and length(attachments) == 1
 47      and all(attachments,
 48              .file_type in $file_types_images
 49              and .size > 2000
 50              and any(file.explode(.),
 51                      regex.icontains(.scan.ocr.raw,
 52                                      "storage.{0,50}full",
 53                                      "free.{0,50}upgrade",
 54                                      "storage.{0,50}details",
 55                                      "storage.{0,50}quot",
 56                                      "email.{0,50}storage",
 57                                      "total.{0,50}storage"
 58                      )
 59              )
 60      )
 61    )
 62  )
 63  and (
 64    strings.icontains(subject.subject,
 65                      "exceeded",
 66                      "out of",
 67                      "mailbox",
 68                      "icloud",
 69                      "all storage used",
 70                      "compliance",
 71                      "critical",
 72                      "problem",
 73                      "max storage",
 74                      "be deleted",
 75                      "action required",
 76                      "undelivered messages",
 77                      "review storage",
 78                      "subscription terminated",
 79                      "final notice",
 80                      "data retention",
 81                      "file deletion",
 82                      "suspend"
 83    )
 84    or regex.icontains(subject.subject,
 85                       '\bfull\b',
 86                       '\blimit(?:ed|\b)',
 87                       "storage (?:space|capacity warning|is used)",
 88                       '(?:upgrade|\bact\b) (?:today|now)',
 89                       'at (?:100|9[0-9](?:\.\d+)?|one[\s-]?hundred) ?(?:percent|%)',
 90                       'back(?:ing|ed)? up'
 91    )
 92  )
 93  
 94  // negate customer service requests about storage
 95  and not any(ml.nlu_classifier(body.current_thread.text).topics,
 96              .name == "Customer Service and Support" and .confidence == "high"
 97  )
 98  
 99  // negate links to loopnet.com - a popular commerical property listing service
100  and not (any(body.links, .href_url.domain.root_domain == "loopnet.com"))
101  
102  // negate legitimate sharepoint storage alerts
103  and (
104    (
105      sender.email.email == "no-reply@sharepointonline.com"
106      and not headers.auth_summary.dmarc.pass
107      and (
108        not all(body.links,
109                .href_url.domain.root_domain in~ (
110                  "sharepoint.com",
111                  "microsoft.com",
112                  "aka.ms"
113                )
114        )
115      )
116    )
117    or sender.email.email != "no-reply@sharepointonline.com"
118  )
119  
120  // negate legitimate iCloud China storage alerts
121  and (
122    (
123      sender.email.email == "noreply@icloud.com.cn"
124      and not headers.auth_summary.dmarc.pass
125      and (
126        not all(body.links,
127                .href_url.domain.root_domain in~ ("icloud.com", "aka.ms")
128        )
129      )
130    )
131    or sender.email.email != "noreply@icloud.com.cn"
132  )
133  
134  // negate bouncebacks and undeliverables
135  and not any(attachments,
136              .content_type in (
137                "message/global-delivery-status",
138                "message/delivery-status",
139              )
140              or (
141                .content_type == "message/rfc822"
142                and any(file.parse_eml(.).attachments,
143                        .content_type in (
144                          "message/global-delivery-status",
145                          "message/delivery-status",
146                        )
147                )
148              )
149  )
150  
151  // negate highly trusted sender domains unless they fail DMARC authentication
152  and (
153    (
154      sender.email.domain.root_domain in $high_trust_sender_root_domains
155      and not headers.auth_summary.dmarc.pass
156    )
157    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
158  )
159  and (
160    not profile.by_sender().solicited
161    or profile.by_sender().any_messages_malicious_or_spam
162  )
163  // negate instances where proofpoint sends a review of a reported message via analyzer
164  and not (
165    sender.email.email == "analyzer@analyzer.securityeducation.com"
166    and any(headers.domains, .root_domain == "pphosted.com")
167    and headers.auth_summary.spf.pass
168    and headers.auth_summary.dmarc.pass
169  )  
170attack_types:
171  - "Credential Phishing"
172tactics_and_techniques:
173  - "Social engineering"
174detection_methods:
175  - "Content analysis"
176  - "Sender analysis"
177
178id: "750f04d6-f68a-564c-9e41-c1e5a58df28f"