Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com)

  1name: "Spam: Default Microsoft Exchange Online sender domain (onmicrosoft.com)"
  2description: "The default Microsoft Exchange Online sender domain, onmicrosoft.com, is commonly used to send unwanted and malicious email. Enable this rule in your environment if receiving email from the onmicrosoft.com domain is unexpected behaviour."
  3type: "rule"
  4severity: "low"
  5source: |
  6  type.inbound
  7  and (
  8    sender.email.domain.root_domain == "onmicrosoft.com"
  9    or (
 10      strings.icontains(sender.display_name, "onmicrosoft.com")
 11      and sender.email.domain.valid == false
 12    )
 13  )
 14  and length(recipients.to) < 2
 15  and length(body.links) > 0
 16  
 17  // bounce-back negations
 18  and not strings.like(sender.email.local_part,
 19                       "*postmaster*",
 20                       "*mailer-daemon*",
 21                       "*administrator*"
 22  )
 23  and not any(attachments,
 24              .content_type in (
 25                "message/rfc822",
 26                "message/delivery-status",
 27                "text/calendar"
 28              )
 29              or (.content_type == "text/plain" and .file_extension == "ics")
 30  )
 31  
 32  // negating legit replies
 33  and not (
 34    (
 35      strings.istarts_with(subject.subject, "RE:")
 36      or strings.istarts_with(subject.subject, "FW:")
 37      or strings.istarts_with(subject.subject, "FWD:")
 38      or regex.imatch(subject.subject,
 39                      '(\[[^\]]+\]\s?){0,3}(re|fwd?|automat.*)\s?:.*'
 40      )
 41      or strings.istarts_with(subject.subject, "Réponse automatique")
 42    )
 43    and (length(headers.references) > 0 and headers.in_reply_to is not null)
 44  )
 45  
 46  // negate auto-replies
 47  and not (
 48    any(headers.hops,
 49        any(.fields, .name =~ "auto-submitted" and .value =~ "auto-generated")
 50        and any(.fields,
 51                .name =~ "X-MS-Exchange-Generated-Message-Source"
 52                and .value not in ("Antispam Quarantine Agent")
 53        )
 54    )
 55  )
 56  
 57  // Microsoft has some legit onmicrosoft domains...
 58  and not (
 59    sender.email.domain.domain == "microsoft.onmicrosoft.com"
 60    and headers.auth_summary.spf.pass
 61    and all(body.links, .href_url.domain.root_domain == "microsoft.com")
 62  )
 63  
 64  // negate legitimate microsoft b2b applications invitations
 65  and not (
 66    length(body.links) > 0
 67    and (
 68      sender.email.local_part == "invites"
 69      and sender.email.domain.root_domain == "onmicrosoft.com"
 70      // infra validated message id
 71      and strings.icontains(headers.message_id, "pepf")
 72    )
 73  )
 74  
 75  // construct the proper sender domain and check against known recipients
 76  and not strings.concat(sender.email.domain.subdomain,
 77                         ".",
 78                         sender.email.domain.tld
 79  ) in $recipient_domains
 80  
 81  // sender profiles
 82  and (
 83    not profile.by_sender().solicited
 84    or (
 85      profile.by_sender().any_messages_malicious_or_spam
 86      and not profile.by_sender().any_messages_benign
 87    )
 88  )
 89  
 90  // negate org domains
 91  and not (
 92    sender.email.domain.domain in $org_domains
 93    and coalesce(headers.auth_summary.dmarc.pass, false)
 94  )  
 95
 96tags:
 97 - "Attack surface reduction"
 98attack_types:
 99  - "Callback Phishing"
100  - "Credential Phishing"
101  - "Spam"
102tactics_and_techniques:
103  - "Free email provider"
104  - "Impersonation: Brand"
105  - "Social engineering"
106detection_methods:
107  - "Content analysis"
108  - "Sender analysis"
109id: "3f2a64ce-28bf-505e-a366-204241610ff9"