Link: QR Code with suspicious language (untrusted sender)

 1name: "Link: QR Code with suspicious language (untrusted sender) "
 2description: |
 3  This rule analyzes image attachments for QR Codes that contain URLs including the recipient's email address. It ensures that the URLs do not link to any organizational domains.
 4  Additionally, it examines the email body using Natural Language Processing to detect credential phishing language.In cases of null bodies,
 5  the rule is conditioned to check the image for any suspicious terms.  
 6type: "rule"
 7severity: "medium"
 8source: |
 9  type.inbound
10  
11  // check image attachments for QR code, will want to add message.screenshot functionality here when it's ready
12  // and length(attachments) < 10
13  and any(attachments,
14          (.file_type in $file_types_images or .file_type == "pdf")
15          and any(file.explode(.),
16                  .scan.qr.type == "url"
17  
18                  // recipient email address is present in the URL, a common tactic used in credential phishing attacks and the url is not in $org_domains
19                  and any(recipients.to,
20                          strings.icontains(..scan.qr.data, .email.email) and .email.domain.valid
21                  )
22                  and .scan.qr.url.domain.root_domain not in $org_domains
23          )
24  )
25  
26  // NLU has identified cred_theft language with high confidence
27  and (
28    any(ml.nlu_classifier(body.current_thread.text).intents,
29        .name == "cred_theft" and .confidence == "high"
30    )
31    or 
32    // the attachment contains suspicious strings
33    (
34      any(attachments,
35          (.file_type in $file_types_images or .file_type == "pdf")
36          and any(file.explode(.),
37                  any(.scan.strings.strings,
38                      regex.icontains(.,
39                                      '(\b2fa\b|\bQ.?R\.?\s?\b|MFA|Muti[ -]?Factor Auth(entication)?)'
40                      )
41                  )
42          )
43      )
44    )
45  )
46  
47  and (
48    profile.by_sender().prevalence in ("new", "outlier")
49    or (
50      profile.by_sender().any_messages_malicious_or_spam
51      and not profile.by_sender().any_false_positives
52    )
53  )
54
55  // negate highly trusted sender domains unless they fail DMARC authentication
56  and (
57    (
58      sender.email.domain.root_domain in $high_trust_sender_root_domains
59      and not headers.auth_summary.dmarc.pass
60    )
61    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
62  )  
63
64attack_types:
65  - "Credential Phishing"
66tactics_and_techniques:
67  - "Impersonation: Brand"
68  - "QR code"
69  - "Social engineering"
70detection_methods:
71  - "Content analysis"
72  - "Computer Vision"
73  - "Natural Language Understanding"
74  - "QR code analysis"
75  - "Sender analysis"
76  - "URL analysis"
77id: "25a84d1c-9578-53e3-98a7-ca9b43abb28b"