Link: Credential phishing link with undisclosed recipients

 1name: "Link: Credential phishing link with undisclosed recipients"
 2description: |
 3    This rule detects messages with "Undisclosed Recipients" that contain a link to a credential phishing page. 
 4type: "rule"
 5severity: "medium"
 6source: |
 7  type.inbound
 8  and (
 9    // No Recipients
10    length(recipients.to) == 0
11    or all(recipients.to, .display_name == "Undisclosed recipients")
12  )
13  and length(recipients.cc) == 0
14  and length(recipients.bcc) == 0
15  and (
16    any(body.links,
17        ml.link_analysis(.).credphish.disposition == "phishing"
18        and ml.link_analysis(.).credphish.confidence in ("medium", "high")
19    )
20    or any(body.current_thread.links,
21           regex.icount(.href_url.path, '\.[a-z]{2,}/') >= 2
22           and not strings.icontains(.href_url.path, .href_url.domain.root_domain)
23    )
24  )
25  // negate highly trusted sender domains unless they fail DMARC authentication
26  and not (
27    sender.email.domain.root_domain in $high_trust_sender_root_domains
28    and coalesce(headers.auth_summary.dmarc.pass, false)
29  )
30  and not profile.by_sender().solicited
31  and not profile.by_sender().any_messages_benign  
32
33attack_types:
34  - "Credential Phishing"
35tactics_and_techniques:
36  - "Evasion"
37detection_methods:
38  - "Computer Vision"
39  - "Header analysis"
40  - "URL screenshot"
41id: "06fc155e-f779-50a7-ad5f-3c3777fbf8f5"