Link: Secure SharePoint file share from new or unusual sender

 1name: "Link: Secure SharePoint file share from new or unusual sender"
 2description: "This ASR rule detects the use of secure SharePoint links which require recipient verifcation before allowing access to the shared file. This has been observed as a method of evading automated analysis of the shared files' content."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  // SharePoint email indicators
 8  and strings.like(body.current_thread.text,
 9                   "*shared a file with you*",
10                   "*shared with you*",
11                   "*invited you to access a file*"
12  )
13  and strings.icontains(subject.subject, "shared")
14  // the Sharepoint file has been "Protected"
15  and any([body.plain.raw, body.current_thread.text],
16          strings.icontains(.,
17                            "This link only works for the direct recipients of this message"
18          )
19  )
20  and any(body.links,
21          .href_url.domain.root_domain == "sharepoint.com"
22          or (
23            .href_url.domain.root_domain in (
24              "mimecastprotect.com",
25              "mimecast.com"
26            )
27            and any(.href_url.query_params_decoded['domain'],
28                    strings.parse_domain(.).root_domain in ("sharepoint.com")
29            )
30          )
31  )
32  and (
33    // sender is uncommon
34    (
35      profile.by_sender_email().prevalence in ("new", "rare", "outlier")
36      and not profile.by_sender_email().solicited
37    )
38    // reply-to logic when the sender is sharepointonline.com
39    or (
40      // or the reply-to address has never sent an email to the org
41      sender.email.domain.root_domain == "sharepointonline.com"
42      and (
43        beta.profile.by_reply_to().prevalence == "new"
44        // senders that send a bunch of messages quickly might not be "new"
45        or beta.profile.by_reply_to().days_known < 7
46        // replicate sender profile logic from above
47        or (
48          beta.profile.by_reply_to().prevalence in ("new", "rare", "outlier")
49          and not beta.profile.by_reply_to().solicited
50        )
51      )
52    )
53    // or the message contains suspect language
54    or strings.icontains(body.current_thread.text, 'kindly')
55  )  
56tags:
57 - "Attack surface reduction"
58attack_types:
59  - "Credential Phishing"
60tactics_and_techniques:
61  - "Free file host"
62  - "Evasion"
63detection_methods:
64  - "Content analysis"
65  - "Sender analysis"
66id: "74ed3020-50f8-5237-8a4d-bd7665a815aa"