Link: Gmail confidential mode message from new or unsolicited sender

 1name: "Link: Gmail confidential mode message from new or unsolicited sender"
 2description: "Detects Gmail confidential mode messages from first-time, unsolicited, or previously malicious senders. Message contents are only viewable after authentication and cannot be scanned."
 3type: "rule"
 4severity: "low"
 5false_positives:
 6  - "Legitimate first-time senders using Gmail confidential mode, sender exclusions should be used to avoid continued/repeat matching of benign messages"
 7source: |
 8  type.inbound
 9  and any(body.links,
10          .href_url.domain.domain == "confidential-mail.google.com"
11          and strings.istarts_with(.href_url.path, "/msg/")
12  )
13  and (
14    (
15      profile.by_sender_email().prevalence in ("new", "outlier")
16      and not profile.by_sender_email().solicited
17    )
18    or (
19      profile.by_sender_email().any_messages_malicious_or_spam
20      and not profile.by_sender_email().any_messages_benign
21    )
22  )  
23tags:
24  - "Attack surface reduction"
25attack_types:
26  - "Credential Phishing"
27tactics_and_techniques:
28  - "Evasion"
29  - "Social engineering"
30detection_methods:
31  - "Sender analysis"
32  - "URL analysis"
33id: "1ef2d01c-c5dd-5c77-bfe0-fac0b1b0edc8"