Link: Suspicious Sharepoint folder share

 1name: "Link: Suspicious Sharepoint folder share"
 2description: "Detection Rule matches on messages which contain a link to a sharepoint shared folder containing a single .url file. These messages must not be sent from sharepoint and are either not solicited or from a new or outlier sender."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(filter(body.links,
 8                 // folder share
 9                 strings.icontains(.href_url.domain.domain, "-my.sharepoint.com")
10                 and strings.icontains(.href_url.url, "/:f:/g/personal")
11  
12                 // remove links which contains the domain sld in the subdomain (tenenat) name
13                 and not any($org_slds,
14                             strings.icontains(..href_url.domain.subdomain, .)
15                 )
16          ),
17          // a single shared URL file
18          length(html.xpath(ml.link_analysis(., mode="aggressive").final_dom,
19                            '//div[@role="row" and starts-with(@data-automationid, "row-")][.//span[@data-id="heroField"][contains(@title, ".url")]][.//button[@data-automationid="manageAccess"]]'
20                 ).nodes
21          ) == 1
22  )
23  
24  // message is not from sharepoint actual
25  and not (
26    strings.starts_with(headers.message_id, '<Share-')
27    and strings.ends_with(headers.message_id, '@odspnotify>')
28  )
29  and (
30    // not solicited
31    not profile.by_sender().solicited
32    // new or outlier sender prevalence
33    or profile.by_sender().prevalence in ("new", "outlier")
34    // marked as spam and no FPs
35    or (
36      profile.by_sender().any_messages_malicious_or_spam
37      and not profile.by_sender().any_messages_benign
38    )
39  )
40  
41  // negate highly trusted sender domains unless they fail DMARC authentication
42  and not (
43    sender.email.domain.root_domain in $high_trust_sender_root_domains
44    and coalesce(headers.auth_summary.dmarc.pass, false)
45  )  
46attack_types:
47  - "Credential Phishing"
48tactics_and_techniques:
49  - "Free file host"
50  - "Evasion"
51detection_methods:
52  - "HTML analysis"
53  - "Header analysis"
54  - "Sender analysis"
55  - "URL analysis"
56id: "6168a08c-6f4f-599f-877f-52efbba51cc4"