Link: Microsoft protected message with suspicious recipient patterns

 1name: "Link: Microsoft protected message with suspicious recipient patterns"
 2description: "Detects when a user receives a protected message (RPMSG) with the to and from headers matching or there is no TO header at all. Benign matches are possible, sender exclusions can be used to avoid matching on senders which commonly use Microsoft protected messages with suspicious recipient patterns"
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // contains the rpmsg
 8  and any(attachments,
 9          .file_extension == "rpmsg"
10          or .content_type == "application/x-microsoft-rpmsg-message"
11  )
12  // contains the proper link
13  and any(body.links,
14          .href_url.domain.root_domain == "office365.com"
15          and (
16            strings.icontains(.href_url.query_params, "InternetMessageID=")
17            or strings.icontains(.href_url.path, '/Encryption/retrieve.ashx')
18          )
19  )
20  and (
21    // self sender 
22    (
23      length(recipients.to) == 1
24      and recipients.to[0].email.email == sender.email.email
25    )
26    // no recipients at all
27    or length(recipients.to) == 0
28  )  
29false_positives:
30  - "Some senders commonly send messages which match this behavior, sender exclusions should be used to avoid continued/repeat matching of benign messages"
31tags:
32 - "Attack surface reduction"
33attack_types:
34  - "Credential Phishing"
35tactics_and_techniques:
36  - "Evasion"
37  - "Social engineering"
38detection_methods:
39  - "Content analysis"
40  - "File analysis"
41  - "Header analysis"
42  - "Sender analysis"
43  - "URL analysis"
44id: "a5a2f75d-88a2-5c19-9b83-fa55c2bd3ccf"