Link: QR Code with suspicious language (first-time sender)
This rule analyzes image attachments for QR Codes that contain URLs including the recipient's email address. It ensures that the URLs do not link to any organizational domains. Additionally, it examines the email body using Natural Language Processing to detect credential phishing language.In cases of null bodies, the rule is conditioned to check the image for any suspicious terms.
Sublime rule (View on GitHub)
1name: "Link: QR Code with suspicious language (first-time sender) "
2description: |
3 This rule analyzes image attachments for QR Codes that contain URLs including the recipient's email address. It ensures that the URLs do not link to any organizational domains.
4 Additionally, it examines the email body using Natural Language Processing to detect credential phishing language.In cases of null bodies,
5 the rule is conditioned to check the image for any suspicious terms.
6type: "rule"
7severity: "medium"
8source: |
9 type.inbound
10
11 // check image attachments for QR code, will want to add message.screenshot functionality here when it's ready
12 // and length(attachments) < 10
13 and any(attachments,
14 (.file_type in $file_types_images or .file_type == "pdf")
15 and any(file.explode(.),
16 .scan.qr.type == "url"
17
18 // recipient email address is present in the URL, a common tactic used in credential phishing attacks and the url is not in $org_domains
19 and any(recipients.to,
20 strings.icontains(..scan.qr.data, .email.email) and .email.domain.valid
21 )
22 and .scan.qr.url.domain.root_domain not in $org_domains
23 )
24 )
25
26 // NLU has identified cred_theft language with high confidence
27 and (
28 any(ml.nlu_classifier(body.current_thread.text).intents,
29 .name == "cred_theft" and .confidence == "high"
30 )
31 or
32 // the attachment contains suspicious strings
33 (
34 any(attachments,
35 (.file_type in $file_types_images or .file_type == "pdf")
36 and any(file.explode(.),
37 any(.scan.strings.strings,
38 regex.icontains(.,
39 '(\b2fa\b|\bQ.?R\.?\s?\b|MFA|Muti[ -]?Factor Auth(entication)?)'
40 )
41 )
42 )
43 )
44 )
45 )
46
47 // first-time sender
48 and (
49 (
50 sender.email.domain.root_domain in $free_email_providers
51 and sender.email.email not in $sender_emails
52 )
53 or (
54 sender.email.domain.root_domain not in $free_email_providers
55 and sender.email.domain.domain not in $sender_domains
56 )
57 )
58attack_types:
59 - "Credential Phishing"
60tactics_and_techniques:
61 - "Impersonation: Brand"
62 - "QR code"
63 - "Social engineering"
64detection_methods:
65 - "Content analysis"
66 - "Computer Vision"
67 - "Natural Language Understanding"
68 - "QR code analysis"
69 - "Sender analysis"
70 - "URL analysis"
71id: "25a84d1c-9578-53e3-98a7-ca9b43abb28b"