Link: Gmail confidential mode message with suspicious recipient patterns

 1name: "Link: Gmail confidential mode message with suspicious recipient patterns"
 2description: "Detects Gmail confidential mode messages where the sender is the only recipient or there are no valid recipients, a pattern used to deliver actor-controlled content that cannot be scanned."
 3type: "rule"
 4severity: "low"
 5false_positives:
 6  - "Some senders commonly send messages which match this behavior, sender exclusions should be used to avoid continued/repeat matching of benign messages"
 7source: |
 8  type.inbound
 9  and any(body.current_thread.links,
10          .href_url.domain.domain == "confidential-mail.google.com"
11          and strings.istarts_with(.href_url.path, "/msg/")
12  )
13  and (
14    // self sender
15    (
16      length(recipients.to) == 1
17      and recipients.to[0].email.email == sender.email.email
18    )
19    // no valid recipients at all
20    or (
21      length(filter(recipients.to, .email.domain.valid)) == 0
22      and not length(filter(recipients.cc, .email.domain.valid)) == 1
23    )
24  )  
25tags:
26  - "Attack surface reduction"
27attack_types:
28  - "Credential Phishing"
29tactics_and_techniques:
30  - "Evasion"
31  - "Social engineering"
32detection_methods:
33  - "Header analysis"
34  - "Sender analysis"
35  - "URL analysis"
36id: "d4b97333-af11-5dde-b607-ccfbd321b6dd"