Spam: Personalized subject and greetings via Salesforce Marketing Cloud

 1name: "Spam: Personalized subject and greetings via Salesforce Marketing Cloud"
 2description: "Detects messages sent through Salesforce Marketing Cloud infrastructure that contain a fake previous email thread, where both the current and previous threads start with the same greeting pattern extracted from the subject line."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  // attempt to find SF sending infra 
 8  and (
 9    headers.domains[0].root_domain == "exacttarget.com"
10    or strings.iends_with(headers.message_id, '.xt.local>')
11    or any(headers.hops,
12           any(.fields,
13               .name =~ "X-SFMC-Stack"
14               or (.name =~ "x-job" and regex.match(.value, '^\d+_\d+$'))
15           )
16    )
17  )
18  // the message contains a fake previous thread
19  and length(body.previous_threads) == 1
20  
21  // extract the name from the subject
22  and any(regex.iextract(subject.base, '(?:^|: )(?P<first_name>[A-Z][a-z]+)$'),
23          // the current thread starts with "Hi <extracted from subject>
24          strings.istarts_with(body.current_thread.text,
25                               strings.concat('Hi ', .named_groups["first_name"])
26          )
27          // the previous thread starts with "Hi <extracted from subject>
28          and any(body.previous_threads,
29                  strings.istarts_with(.text,
30                                       strings.concat('Hi ',
31                                                      ..named_groups["first_name"]
32                                       )
33                  )
34          )
35  )
36    
37
38attack_types:
39  - "Spam"
40tactics_and_techniques:
41  - "Social engineering"
42detection_methods:
43  - "Content analysis"
44  - "Header analysis"
45id: "c77f127f-e495-5659-96ec-29aec02070d7"