Mass campaign: recipient address in subject, body, and link (first-time sender)

 1name: "Mass campaign: recipient address in subject, body, and link (first-time sender)"
 2description: |
 3  This detects a pattern commonly observed in mass phishing campaigns.
 4
 5  The local_part or the full email address of the recipient is used in the subject,
 6  body, and link query parameter to "personalize" the attack.  
 7references:
 8  - "https://playground.sublimesecurity.com?id=d9143109-8886-4639-b634-d0a671848eb6"
 9type: "rule"
10severity: "medium"
11source: |
12  type.inbound
13  and length(recipients.to) + length(recipients.bcc) + length(recipients.cc) == 1
14
15  // exclude To: Undisclosed recipients:;
16  // since we won't have a valid recipient email
17  and any(recipients.to, .email.domain.valid == true)
18
19  // first-time sender
20  and (
21    (
22      sender.email.domain.root_domain in $free_email_providers
23      and sender.email.email not in $sender_emails
24    )
25    or (
26      sender.email.domain.root_domain not in $free_email_providers
27      and sender.email.domain.domain not in $sender_domains
28    )
29  )
30  and (
31    any(recipients.to,
32        strings.icontains(subject.subject, .email.email)
33        or strings.icontains(subject.subject, .email.local_part)
34    )
35  )
36  and any([body.html.inner_text, body.plain.raw],
37          any(recipients.to, strings.icontains(.., .email.email))
38  )
39  and any(body.links, any(recipients.to, strings.icontains(..href_url.query_params, .email.email)))
40  and any(ml.nlu_classifier(coalesce(body.html.display_text, body.plain.raw)).intents,
41          .name in ("cred_theft") and .confidence == "high"
42  )
43  and any(ml.nlu_classifier(body.current_thread.text).intents,
44          .name in ("cred_theft") and .confidence == "high"
45  )  
46attack_types:
47  - "Credential Phishing"
48tactics_and_techniques:
49  - "Social engineering"
50detection_methods:
51  - "Header analysis"
52  - "Natural Language Understanding"
53  - "Sender analysis"
54id: "599dabf5-6287-5adf-8a8f-70649ccf0f92"