Link: Self-sender with sender org in subject and credential theft indicator

 1name: "Link: Self-sender with sender org in subject and credential theft indicator"
 2description: "Detects messages where the sender and recipient are the same email address, containing organizational names in the subject, credential theft language with high confidence, and suspicious links. These messages often bypass traditional security measures by appearing to come from the recipient themselves."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  // self sender behavior
 8  and length(recipients.to) == 1
 9  and length(recipients.cc) == 0
10  and sender.email.email == recipients.to[0].email.email
11  
12  // not self sender from the org_domain, this rule is not going to detect spoofed domains to limit FPs caused by various email auth issues.
13  and not sender.email.domain.domain in $org_domains
14  and (
15    profile.by_sender_email().prevalence == "new"
16    // potential thread hijacking
17    or (
18      length(body.previous_threads) > 1
19      // most recent thread is a reply to this sender
20      and any(body.previous_threads[0].recipients.to,
21              strings.icontains(.email.email, sender.email.email)
22      )
23      // short current_thread
24      and length(body.current_thread.text) < 500
25    )
26  )
27  // org name in the subject, removing the subject from NLU to prevent the org being extracted from the subject
28  and any(filter(ml.nlu_classifier(body.current_thread.text, subject="").entities,
29                 .name == "org"
30                 and .text != sender.email.domain.sld
31                 and .text != sender.email.domain.domain
32          ),
33          // not an icontains, make it an exact match
34          strings.contains(subject.base, .text)
35  )
36  // must contain a link
37  and 0 < length(body.current_thread.links) < 20
38  
39  // cred theft
40  and (
41    (
42      any(ml.nlu_classifier(body.current_thread.text).intents,
43          .name == "cred_theft" and .confidence == "high"
44      )
45      // or suspicious NLU topics
46      or (
47        any(ml.nlu_classifier(body.current_thread.text).topics,
48            .name in ("Request to View Invoice", "E-Signature")
49            and .confidence != "low"
50        )
51        // with excessive whitespace
52        and regex.icount(body.html.raw, '(<br\s*/?>[\s\n]*)') > 50
53      )
54    )
55  )
56  
57  // all attachments are inline images or there are 0 attachments
58  and (
59    length(attachments) == 0
60    // there are only image attachments and all image attachments are served inline
61    or (
62      length(attachments) > 0
63      and (
64        all(attachments,
65            .file_type in $file_types_images
66            // all images are embedded in the html
67            and strings.icontains(body.html.raw,
68                                  strings.concat('src="cid:', .content_id)
69            )
70        )
71      )
72    )
73  )  
74tags:
75 - "Attack surface reduction"
76attack_types:
77  - "Credential Phishing"
78tactics_and_techniques:
79  - "Social engineering"
80  - "Evasion"
81detection_methods:
82  - "Natural Language Understanding"
83  - "Content analysis"
84  - "Sender analysis"
85  - "URL analysis"
86  - "Header analysis"
87id: "bfa9aa08-ed3b-5e4a-a83c-192efd126530"