Link: QR Code with suspicious language (first-time sender)

 1name: "Link: QR Code with suspicious language (first-time sender) "
 2description: |
 3  This rule analyzes image attachments for QR Codes that contain URLs including the recipient's email address. It ensures that the URLs do not link to any organizational domains.
 4  Additionally, it examines the email body using Natural Language Processing to detect credential phishing language.In cases of null bodies,
 5  the rule is conditioned to check the image for any suspicious terms.  
 6type: "rule"
 7severity: "medium"
 8source: |
 9  type.inbound
10  
11  // check image attachments for QR code, will want to add message.screenshot functionality here when it's ready
12  // and length(attachments) < 10
13  and any(attachments,
14          (.file_type in $file_types_images or .file_type == "pdf")
15          and any(file.explode(.),
16                  .scan.qr.type == "url"
17  
18                  // recipient email address is present in the URL, a common tactic used in credential phishing attacks and the url is not in $org_domains
19                  and any(recipients.to,
20                          strings.icontains(..scan.qr.data, .email.email) and .email.domain.valid
21                  )
22                  and .scan.qr.url.domain.root_domain not in $org_domains
23          )
24  )
25  
26  // NLU has identified cred_theft language with high confidence
27  and (
28    any(ml.nlu_classifier(body.current_thread.text).intents,
29        .name == "cred_theft" and .confidence == "high"
30    )
31    or 
32    // the attachment contains suspicious strings
33    (
34      any(attachments,
35          (.file_type in $file_types_images or .file_type == "pdf")
36          and any(file.explode(.),
37                  any(.scan.strings.strings,
38                      regex.icontains(.,
39                                      '(\b2fa\b|\bQ.?R\.?\s?\b|MFA|Muti[ -]?Factor Auth(entication)?)'
40                      )
41                  )
42          )
43      )
44    )
45  )
46  
47  // first-time sender
48  and (
49    (
50      sender.email.domain.root_domain in $free_email_providers
51      and sender.email.email not in $sender_emails
52    )
53    or (
54      sender.email.domain.root_domain not in $free_email_providers
55      and sender.email.domain.domain not in $sender_domains
56    )
57  )  
58attack_types:
59  - "Credential Phishing"
60tactics_and_techniques:
61  - "Impersonation: Brand"
62  - "QR code"
63  - "Social engineering"
64detection_methods:
65  - "Content analysis"
66  - "Computer Vision"
67  - "Natural Language Understanding"
68  - "QR code analysis"
69  - "Sender analysis"
70  - "URL analysis"
71id: "25a84d1c-9578-53e3-98a7-ca9b43abb28b"