Reconnaissance: Short generic greeting message

  1name: "Reconnaissance: Short generic greeting message"
  2description: |
  3    Detects potential reconnaissance messages with very short, generic content like 'Hi' or 'Hello' from external senders. These messages are often used to validate email addresses and test deliverability before launching larger attacks.
  4type: "rule"
  5severity: "medium"
  6source: |
  7  type.inbound
  8  // detect generic greetings
  9  and length(body.current_thread.text) <= 20
 10  and (
 11    length(subject.base) <= 15
 12    // tighter scoped tactics
 13    or (
 14      length(subject.base) <= 20
 15      and (
 16        regex.icontains(subject.base, '(?:hello|hi) this is')
 17        or (
 18          regex.icontains(subject.base, 'hello|hi')
 19          and any(recipients.to,
 20                  strings.icontains(subject.base, .email.domain.sld)
 21          )
 22        )
 23      )
 24    )
 25  )
 26  // exclude messages with previous thread context (forwards/replies)
 27  and length(body.previous_threads) == 0
 28  and (
 29    any(ml.nlu_classifier(body.current_thread.text).entities, .name == "greeting")
 30    or strings.ilike(body.current_thread.text, "*hi*", "*hello*", "*hey*")
 31    or length(body.current_thread.text) <= 5
 32    or regex.match(body.current_thread.text, '\d+')
 33  )
 34  // external freemail sender
 35  and sender.email.domain.root_domain in $free_email_providers
 36  and (
 37    sender.email.domain.root_domain not in (
 38      recipients.to[0].email.domain.root_domain
 39    )
 40    or (
 41      (
 42        all(recipients.to, .email.domain.valid == false)
 43        and all(recipients.cc, .email.domain.valid == false)
 44      )
 45      or length(recipients.to) == 0
 46    )
 47  )
 48  and (
 49    length(recipients.cc) == 0
 50    or (
 51      length(recipients.cc) > 0
 52      and all(recipients.cc,
 53              .email.domain.root_domain != sender.email.domain.root_domain
 54      )
 55    )
 56  )
 57  and (
 58    length(recipients.bcc) == 0
 59    or (
 60      length(recipients.bcc) > 0
 61      and all(recipients.bcc,
 62              .email.domain.root_domain != sender.email.domain.root_domain
 63      )
 64    )
 65  )
 66  // no attachments or links
 67  and length(attachments) == 0
 68  and length(body.current_thread.links) == 0
 69  
 70  // not where the sender and mailbox display_anames indicate this might be a personal email --> work email
 71  // impersonation is covered by other core feed rules
 72  and not (
 73    sum([length(recipients.to), length(recipients.bcc), length(recipients.cc)]) == 1
 74    // use coalesce to deal with either the sender.display_name or the mailbox element being null
 75    // if either are null, the function returns false, as it cannot be true if either is null
 76    and coalesce(strings.icontains(sender.display_name, mailbox.first_name),
 77                 false
 78    )
 79    and coalesce(strings.icontains(sender.display_name, mailbox.last_name), false)
 80  )
 81  and (
 82    // auth failed (or absent) - ignore the profile
 83    coalesce(headers.auth_summary.dmarc.pass, false) == false
 84    or coalesce(headers.auth_summary.spf.pass, false) == false
 85    // auth passed - use the profile
 86    or (
 87      // no benign messages
 88      not profile.by_sender_email().any_messages_benign
 89      and (
 90        // not soliticed OR common
 91        not (
 92          profile.by_sender_email().solicited
 93          or profile.by_sender_email().prevalence == "common"
 94        )
 95        // or HAS been spam_malicious
 96        or profile.by_sender_email().any_messages_malicious_or_spam
 97      )
 98    )
 99  )
100    
101tags:
102 - "Attack surface reduction"
103attack_types:
104  - "BEC/Fraud"
105  - "Callback Phishing"
106tactics_and_techniques:
107  - "Social engineering"
108  - "Free email provider"
109detection_methods:
110  - "Content analysis"
111  - "Header analysis"
112  - "Natural Language Understanding"
113  - "Sender analysis"
114id: "c67dedab-91f5-5bbe-af81-f9895a02c065"