Spam: Personalized subject and greetings via Salesforce Marketing Cloud

 1name: "Spam: Personalized subject and greetings via Salesforce Marketing Cloud"
 2description: "Detects messages sent through Salesforce Marketing Cloud infrastructure that contain a fake previous email thread, where both the current and previous threads start with the same greeting pattern extracted from the subject line."
 3type: "rule"
 4severity: "low"
 5source: |
 6  type.inbound
 7  // attempt to find SF sending infra
 8  and (
 9    headers.domains[0].root_domain in ("exacttarget.com", "pd25.com")
10    or strings.iends_with(headers.message_id, '.xt.local>')
11    or any(headers.hops,
12           any(.fields,
13               .name =~ "X-SFMC-Stack"
14               or (.name =~ "x-job" and regex.match(.value, '^\d+_\d+$'))
15           )
16    )
17  )
18  // the message contains a fake previous thread
19  and length(body.previous_threads) == 1
20  
21  // extract the name from the subject
22  and any(regex.iextract(subject.base,
23                         '(?:^|: )(?P<first_name>[A-Z][a-z]+)(?:$| \|)'
24          ),
25          // the current thread starts with "Hi <extracted from subject>
26          strings.istarts_with(body.current_thread.text,
27                               strings.concat('Hi ', .named_groups["first_name"])
28          )
29          // strip nlu greeting + first name
30          or any(ml.nlu_classifier(body.current_thread.text).entities,
31                 .name == "greeting"
32                 and strings.istarts_with(body.current_thread.text,
33                                          strings.concat(.text,
34                                                         ' ',
35                                                         ..named_groups["first_name"]
36                                          )
37                 )
38          )
39          // the previous thread starts with "Hi <extracted from subject>
40          or any(body.previous_threads,
41                 strings.istarts_with(.text,
42                                      strings.concat('Hi ',
43                                                     ..named_groups["first_name"]
44                                      )
45                 )
46                 // strip nlu greeting + first name
47                 or any(ml.nlu_classifier(.text).entities,
48                        .name == "greeting"
49                        and strings.istarts_with(..text,
50                                                 strings.concat(.text,
51                                                                ' ',
52                                                                ...named_groups["first_name"]
53                                                 )
54                        )
55                 )
56          )
57  )
58    
59
60attack_types:
61  - "Spam"
62tactics_and_techniques:
63  - "Social engineering"
64detection_methods:
65  - "Content analysis"
66  - "Header analysis"
67id: "c77f127f-e495-5659-96ec-29aec02070d7"