Link: File sharing impersonation with suspicious language and sending patterns

 1name: "Link: File sharing impersonation with suspicious language and sending patterns"
 2description: "Detects messages containing file sharing and cloud services topics combined with BEC or credential theft language, featuring links with document-related display text that lead to low-reputation domains outside the sender's domain and organization."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(ml.nlu_classifier(body.current_thread.text).topics,
 8          .name == "File Sharing and Cloud Services" and .confidence != "low"
 9  )
10  and any(ml.nlu_classifier(body.current_thread.text).intents,
11          .name in ("bec", "cred_theft") and .confidence != "low"
12  )
13  and any(body.links,
14          regex.icontains(.display_text,
15                          "document",
16                          "download",
17                          "message",
18                          "view file"
19          )
20          and .href_url.domain.root_domain != sender.email.domain.root_domain
21          and .href_url.domain.root_domain not in $tranco_1m
22          and .href_url.domain.root_domain not in $org_domains
23          and .href_url.domain.valid
24  
25          // Exclude legitimate document services
26          and not .href_url.domain.root_domain in $free_file_hosts
27  )
28  // suspicious sending/recipient pattern
29  and 1 of (
30    (
31      length(recipients.to) == 1
32      and recipients.to[0].email.email == sender.email.email
33    ),
34    any(headers.reply_to,
35        .email.domain.domain in $free_email_providers
36        and .email.domain.domain != sender.email.domain.domain
37    ),
38    (
39      length(recipients.to) == 1
40      and length(recipients.cc) == 1
41      and recipients.to[0].email.email == recipients.cc[0].email.email
42    ),
43    (
44      strings.icontains(headers.return_path.local_part, "+SRS=")
45      or strings.icontains(headers.auth_summary.spf.details.designator, "+SRS=")
46      or any(headers.hops,
47             strings.icontains(.authentication_results.spf_details.designator,
48                               '+SRS='
49             )
50      )
51    ),
52    // No recipients visible
53    (
54      length(recipients.to) == 0
55      or (
56        all(recipients.to, .email.domain.valid == false)
57        and all(recipients.cc, .email.domain.valid == false)
58      )
59    )
60    and length(recipients.cc) == 0
61  )
62  
63  // negate highly trusted sender domains unless they fail DMARC authentication
64  and not (
65    sender.email.domain.root_domain in $high_trust_sender_root_domains
66    and coalesce(headers.auth_summary.dmarc.pass, false)
67  )  
68
69attack_types:
70  - "BEC/Fraud"
71  - "Credential Phishing"
72tactics_and_techniques:
73  - "Social engineering"
74  - "Free subdomain host"
75  - "Impersonation: Brand"
76detection_methods:
77  - "Natural Language Understanding"
78  - "URL analysis"
79  - "Sender analysis"
80  - "Header analysis"
81  - "Content analysis"
82id: "d3363041-f38d-538c-8633-29d7d6f80ca7"