Mass campaign: recipient address in subject, body, and link (untrusted sender)

 1name: "Mass campaign: recipient address in subject, body, and link (untrusted sender)"
 2description: |
 3  This detects a pattern commonly observed in mass phishing campaigns.
 4
 5  The local_part or the full email address of the recipient is used in the subject,
 6  body, and link query parameter to "personalize" the attack.  
 7references:
 8  - "https://playground.sublimesecurity.com?id=d9143109-8886-4639-b634-d0a671848eb6"
 9type: "rule"
10severity: "medium"
11source: |
12  type.inbound
13  and length(recipients.to) + length(recipients.bcc) + length(recipients.cc) == 1
14
15  // exclude To: Undisclosed recipients:;
16  // since we won't have a valid recipient email
17  and any(recipients.to, .email.domain.valid == true)
18  and (
19    profile.by_sender().prevalence in ("new", "outlier")
20    or (
21      profile.by_sender().any_messages_malicious_or_spam
22      and not profile.by_sender().any_false_positives
23    )
24  )
25  and (
26    any(recipients.to,
27        (
28          strings.icontains(subject.subject, .email.email)
29          or strings.icontains(subject.subject, .email.local_part)
30        )
31        and (.email.domain.valid or strings.icontains(.display_name, "undisclosed"))
32    )
33  )
34  and any(recipients.to, strings.icontains(body.current_thread.text, .email.email))
35  and any(body.links,
36          any(recipients.to,
37              strings.icontains(..href_url.query_params, .email.email)
38          )
39          and (
40            (
41              not strings.icontains(.display_text, "unsubscribe")
42              and not strings.icontains(.href_url.path, "unsubscribe")
43            )
44          )
45  )
46  and any(ml.nlu_classifier(body.current_thread.text).intents,
47          .name in ("cred_theft") and .confidence == "high"
48  )
49  
50  // negate highly trusted sender domains unless they fail DMARC authentication
51  and (
52    (
53      sender.email.domain.root_domain in $high_trust_sender_root_domains
54      and not headers.auth_summary.dmarc.pass
55    )
56    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
57  )  
58attack_types:
59  - "Credential Phishing"
60tactics_and_techniques:
61  - "Social engineering"
62detection_methods:
63  - "Header analysis"
64  - "Natural Language Understanding"
65  - "Sender analysis"
66id: "599dabf5-6287-5adf-8a8f-70649ccf0f92"