Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com)

 1name: "Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com)"
 2description: "The default Microsoft Exchange Online sender domain, onmicrosoft.com, is commonly used to send unwanted and malicious email. Enable this rule in your environment if receiving email from the onmicrosoft.com domain is unexpected behaviour."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  and (
 8    sender.email.domain.root_domain == "onmicrosoft.com"
 9    or (
10      strings.icontains(sender.display_name, "onmicrosoft.com")
11      and sender.email.domain.valid == false
12    )
13  )
14  and length(recipients.to) < 2
15  and length(body.links) > 0
16  // bounce-back negations
17  and not strings.like(sender.email.local_part,
18                       "*postmaster*",
19                       "*mailer-daemon*",
20                       "*administrator*"
21  )
22  and not any(attachments,
23              .content_type in (
24                "message/rfc822",
25                "message/delivery-status",
26                "text/calendar"
27              )
28              or (.content_type == "text/plain" and .file_extension == "ics")
29  )
30  // negating legit replies
31  and not (
32    (
33      strings.istarts_with(subject.subject, "RE:")
34      or strings.istarts_with(subject.subject, "FW:")
35      or strings.istarts_with(subject.subject, "FWD:")
36      or regex.imatch(subject.subject,
37                      '(\[[^\]]+\]\s?){0,3}(re|fwd?|automat.*)\s?:.*'
38      )
39      or strings.istarts_with(subject.subject, "Réponse automatique")
40    )
41    and (
42      length(headers.references) > 0
43      and any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
44    )
45  )
46  // negating auto-replies
47  and not (
48    any(headers.hops,
49        any(.fields, .name =~ "auto-submitted" and .value =~ "auto-generated")
50        and any(.fields,
51                .name =~ "X-MS-Exchange-Generated-Message-Source"
52                and .value not in ("Antispam Quarantine Agent")
53        )
54    )
55  )
56  // Microsoft has some legit onmicrosoft domains...
57  and not (
58    sender.email.domain.domain == "microsoft.onmicrosoft.com"
59    and headers.auth_summary.spf.pass
60    and all(body.links, .href_url.domain.root_domain == "microsoft.com")
61  )
62  // construct the proper sender domain and check against known recipients
63  and not strings.concat(sender.email.domain.subdomain,
64                         ".",
65                         sender.email.domain.tld
66  ) in $recipient_domains
67  and (
68    not profile.by_sender().solicited
69    or (
70      profile.by_sender().any_messages_malicious_or_spam
71      and not profile.by_sender().any_messages_benign
72    )
73  )
74  and not sender.email.domain.domain in $org_domains  
75tags:
76 - "Attack surface reduction"
77attack_types:
78  - "Callback Phishing"
79  - "Credential Phishing"
80  - "Spam"
81tactics_and_techniques:
82  - "Free email provider"
83  - "Impersonation: Brand"
84  - "Social engineering"
85detection_methods:
86  - "Content analysis"
87  - "Sender analysis"
88id: "3f2a64ce-28bf-505e-a366-204241610ff9"