Link: QR Code with suspicious language (first-time sender)

This rule analyzes image attachments for QR Codes that contain URLs including the recipient's email address. It ensures that the URLs do not link to any organizational domains. Additionally, it examines the email body using Natural Language Processing to detect credential phishing language.In cases of null bodies, the rule is conditioned to check the image for any suspicious terms.

Sublime rule (View on GitHub)

 1name: "Link: QR Code with suspicious language (first-time sender) "
 2description: |
 3  This rule analyzes image attachments for QR Codes that contain URLs including the recipient's email address. It ensures that the URLs do not link to any organizational domains.
 4  Additionally, it examines the email body using Natural Language Processing to detect credential phishing language.In cases of null bodies,
 5  the rule is conditioned to check the image for any suspicious terms.  
 6type: "rule"
 7severity: "medium"
 8source: |
 9  type.inbound
10  
11  // check image attachments for QR code, will want to add message.screenshot functionality here when it's ready
12  // and length(attachments) < 10
13  and any(attachments,
14          (.file_type in $file_types_images or .file_type == "pdf")
15          and any(file.explode(.),
16                  .scan.qr.type == "url"
17  
18                  // recipient email address is present in the URL, a common tactic used in credential phishing attacks and the url is not in $org_domains
19                  and any(recipients.to,
20                          strings.icontains(..scan.qr.data, .email.email) and .email.domain.valid
21                  )
22                  and .scan.qr.url.domain.root_domain not in $org_domains
23          )
24  )
25  
26  // NLU has identified cred_theft language with high confidence
27  and (
28    any(ml.nlu_classifier(body.current_thread.text).intents,
29        .name == "cred_theft" and .confidence == "high"
30    )
31    or 
32    // the attachment contains suspicious strings
33    (
34      any(attachments,
35          (.file_type in $file_types_images or .file_type == "pdf")
36          and any(file.explode(.),
37                  any(.scan.strings.strings,
38                      regex.icontains(.,
39                                      '(\b2fa\b|\bQ.?R\.?\s?\b|MFA|Muti[ -]?Factor Auth(entication)?)'
40                      )
41                  )
42          )
43      )
44    )
45  )
46  
47  // first-time sender
48  and (
49    (
50      sender.email.domain.root_domain in $free_email_providers
51      and sender.email.email not in $sender_emails
52    )
53    or (
54      sender.email.domain.root_domain not in $free_email_providers
55      and sender.email.domain.domain not in $sender_domains
56    )
57  )  
58attack_types:
59  - "Credential Phishing"
60tactics_and_techniques:
61  - "Impersonation: Brand"
62  - "QR code"
63  - "Social engineering"
64detection_methods:
65  - "Content analysis"
66  - "Computer Vision"
67  - "Natural Language Understanding"
68  - "QR code analysis"
69  - "Sender analysis"
70  - "URL analysis"
71id: "25a84d1c-9578-53e3-98a7-ca9b43abb28b"
to-top