Salesforce Infrastructure Abuse

Identifies messages that resemble credential theft, originating from Salesforce. Salesforce infrastrcture abuse has been observed recently to send phishing attacks.

Sublime rule (View on GitHub)

  1name: "Salesforce Infrastructure Abuse"
  2description: "Identifies messages that resemble credential theft, originating from Salesforce. Salesforce infrastrcture abuse has been observed recently to send phishing attacks."
  3type: "rule"
  4severity: "medium"
  5source: |
  6  type.inbound
  7  
  8  // we look at the return-path because many times in the abuse
  9  // we've seen, the From is a custom domain
 10  and headers.return_path.domain.root_domain == "salesforce.com"
 11  
 12  // legit salesforce email addresses that haven't been observed to be abused
 13  and sender.email.email not in ("support@salesforce.com")
 14  and length(attachments) == 0
 15  and length(body.links) > 0
 16  and any(ml.nlu_classifier(body.current_thread.text).intents,
 17          .name == "cred_theft" and .confidence == "high"
 18  )
 19  and 1 of (
 20    ( // sender domain matches no body domains
 21      length(body.links) > 0
 22      and all(body.links,
 23              .href_url.domain.root_domain != sender.email.domain.root_domain
 24              and .href_url.domain.root_domain not in (
 25                "salesforce.com",
 26                "force.com"
 27              )
 28      )
 29    ),
 30    regex.icontains(subject.subject,
 31                    "termination.*notice",
 32                    "38417",
 33                    ":completed",
 34                    "[il1]{2}mit.*ma[il1]{2} ?bo?x",
 35                    "[il][il][il]egai[ -]",
 36                    "[li][li][li]ega[li] attempt",
 37                    "[ng]-?[io]n .*block",
 38                    "[ng]-?[io]n .*cancel",
 39                    "[ng]-?[io]n .*deactiv",
 40                    "[ng]-?[io]n .*disabl",
 41                    "action.*required",
 42                    "abandon.*package",
 43                    "about.your.account",
 44                    "acc(ou)?n?t (is )?on ho[li]d",
 45                    "acc(ou)?n?t.*terminat",
 46                    "acc(oun)?t.*[il1]{2}mitation",
 47                    "access.*limitation",
 48                    "account (will be )?block",
 49                    "account.*de-?activat",
 50                    "account.*locked",
 51                    "account.*re-verification",
 52                    "account.*security",
 53                    "account.*suspension",
 54                    "account.has.been",
 55                    "account.has.expired",
 56                    "account.will.be.blocked",
 57                    "account v[il]o[li]at",
 58                    "activity.*acc(oun)?t",
 59                    "almost.full",
 60                    "app[li]e.[il]d",
 61                    "authenticate.*account",
 62                    "been.*suspend",
 63                    "clos.*of.*account.*processed",
 64                    "confirm.your.account",
 65                    "courier.*able",
 66                    "crediential.*notif",
 67                    "deactivation.*in.*progress",
 68                    "delivery.*attempt.*failed",
 69                    "document.received",
 70                    "documented.*shared.*with.*you",
 71                    "dropbox.*document",
 72                    "e-?ma[il1]+ .{010}suspen",
 73                    "e-?ma[il1]{1} user",
 74                    "e-?ma[il1]{2} acc",
 75                    "e-?ma[il1]{2}.*up.?grade",
 76                    "e.?ma[il1]{2}.*server",
 77                    "e.?ma[il1]{2}.*suspend",
 78                    "email.update",
 79                    "faxed you",
 80                    "fraud(ulent)?.*charge",
 81                    "from.helpdesk",
 82                    "fu[il1]{2}.*ma[il1]+[ -]?box",
 83                    "has.been.*suspended",
 84                    "has.been.limited",
 85                    "have.locked",
 86                    "he[li]p ?desk upgrade",
 87                    "heipdesk",
 88                    "i[il]iega[il]",
 89                    "ii[il]ega[il]",
 90                    "incoming e?mail",
 91                    "incoming.*fax",
 92                    "lock.*security",
 93                    "ma[il1]{1}[ -]?box.*quo",
 94                    "ma[il1]{2}[ -]?box.*fu[il1]",
 95                    "ma[il1]{2}box.*[il1]{2}mit",
 96                    "ma[il1]{2}box stor",
 97                    "mail on.?hold",
 98                    "mail.*box.*migration",
 99                    "mail.*de-?activat",
100                    "mail.update.required",
101                    "mails.*pending",
102                    "messages.*pending",
103                    "missed.*shipping.*notification",
104                    "missed.shipment.notification",
105                    "must.update.your.account",
106                    "new [sl][io]g?[nig][ -]?in from",
107                    "new voice ?-?mail",
108                    "notifications.*pending",
109                    "office.*3.*6.*5.*suspend",
110                    "office365",
111                    "on google docs with you",
112                    "online doc",
113                    "password.*compromised",
114                    "periodic maintenance",
115                    "potential(ly)? unauthorized",
116                    "refund not approved",
117                    "report",
118                    "revised.*policy",
119                    "scam",
120                    "scanned.?invoice",
121                    "secured?.update",
122                    "security breach",
123                    "securlty",
124                    "signed.*delivery",
125                    "status of your .{314}? ?delivery",
126                    "susp[il1]+c[il1]+ous.*act[il1]+v[il1]+ty",
127                    "suspicious.*sign.*[io]n",
128                    "suspicious.activit",
129                    "temporar(il)?y deactivate",
130                    "temporar[il1]{2}y disab[li]ed",
131                    "temporarily.*lock",
132                    "un-?usua[li].activity",
133                    "unable.*deliver",
134                    "unauthorized.*activit",
135                    "unauthorized.device",
136                    "undelivered message",
137                    "unread.*doc",
138                    "unusual.activity",
139                    "upgrade.*account",
140                    "upgrade.notice",
141                    "urgent message",
142                    "urgent.verification",
143                    "v[il1]o[li1]at[il1]on security",
144                    "va[il1]{1}date.*ma[il1]{2}[ -]?box",
145                    "verification ?-?require",
146                    "verification( )?-?need",
147                    "verify.your?.account",
148                    "web ?-?ma[il1]{2}",
149                    "web[ -]?ma[il1]{2}",
150                    "will.be.suspended",
151                    "your (customer )?account .as",
152                    "your.office.365",
153                    "your.online.access",
154                    // https://github.com/sublime-security/static-files/blob/master/suspicious_subjects.txt
155                    "account has been limited",
156                    "action required",
157                    "almost full",
158                    "apd notifi cation",
159                    "are you at your desk",
160                    "are you available",
161                    "attached file to docusign",
162                    "banking is temporarily unavailable",
163                    "bankofamerica",
164                    "closing statement invoice",
165                    "completed: docusign",
166                    "de-activation of",
167                    "delivery attempt",
168                    "delivery stopped for shipment",
169                    "detected suspicious",
170                    "detected suspicious actvity",
171                    "docu sign",
172                    "document for you",
173                    "document has been sent to you via docusign",
174                    "document is ready for signature",
175                    "docusign",
176                    "encrypted message",
177                    "failed delivery",
178                    "fedex tracking",
179                    "file was shared",
180                    "freefax",
181                    "fwd: due invoice paid",
182                    "has shared",
183                    "inbox is full",
184                    "invitation to comment",
185                    "invitation to edit",
186                    "invoice due",
187                    "left you a message",
188                    "message from",
189                    "new message",
190                    "new voicemail",
191                    "on desk",
192                    "out of space",
193                    "password reset",
194                    "payment status",
195                    "quick reply",
196                    "re: w-2",
197                    "required",
198                    "required: completed docusign",
199                    "remittance",
200                    "ringcentral",
201                    "scanned image",
202                    "secured files",
203                    "secured pdf",
204                    "security alert",
205                    "new sign-in",
206                    "new sign in",
207                    "sign-in attempt",
208                    "sign in attempt",
209                    "staff review",
210                    "suspicious activity",
211                    "unrecognized login attempt",
212                    "upgrade immediately",
213                    "urgent",
214                    "wants to share",
215                    "w2",
216                    "you have notifications pending",
217                    "your account",
218                    "your amazon order",
219                    "your document settlement",
220                    "your order with amazon",
221                    "your password has been compromised",
222    ),
223    any($suspicious_subjects, strings.icontains(subject.subject, .))
224  )
225  and (
226    // if the From is a custom domain, check that it's an unknown sender
227    // otherwise, it should be from salesforce
228    (
229      sender.email.domain.domain == "salesforce.com"
230      and any(headers.hops,
231              any(.fields,
232                  .name == "X-SFDC-EmailCategory" and .value == "apiMassMail"
233              )
234      )
235    )
236    or (
237      (
238        (
239          profile.by_sender().prevalence in ("new", "outlier")
240          and not profile.by_sender().solicited
241        )
242        or (
243          profile.by_sender().any_messages_malicious_or_spam
244          and not profile.by_sender().any_false_positives
245        )
246      )
247  
248      // negate highly trusted sender domains unless they fail DMARC authentication
249      and (
250        (
251          sender.email.domain.root_domain in $high_trust_sender_root_domains
252          and not headers.auth_summary.dmarc.pass
253        )
254        or sender.email.domain.root_domain not in $high_trust_sender_root_domains
255      )
256    )
257  )  
258
259attack_types:
260  - "Credential Phishing"
261tactics_and_techniques:
262  - "Evasion"
263  - "Social engineering"
264detection_methods:
265  - "Content analysis"
266  - "Header analysis"
267  - "Natural Language Understanding"
268  - "URL analysis"
269id: "78a77c70-4008-545a-812f-bde793b72c29"
to-top