Suspicious subject with long procedurally generated text blob

 1name: "Suspicious subject with long procedurally generated text blob"
 2description: "This rule identifies subjects containing long strings of nonsensical or procedurally generated characters, which are often used in phishing or spam campaigns for campaign tracking and identification, as well as to bypass detection filters."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // "#" symbol, and then letters, numbers or more symbols (-#)
 8  and regex.imatch(subject.subject, ".*#[a-z0-9-#]+$")
 9  // not JUST letters
10  and not regex.imatch(subject.subject, ".*#[a-z-]+$")
11  // not JUST numbers
12  and not regex.imatch(subject.subject, ".*#[0-9-]+$")
13  and not any(beta.ml_topic(body.current_thread.text).topics,
14              .name in (
15                "Professional and Career Development",
16                "Reminders and Notifications"
17              )
18              and .confidence == "high"
19  )
20  
21  // and 1 other suspicious element
22  and 2 of (
23    any(recipients.to, strings.icontains(sender.display_name, .email.domain.sld)),
24    (
25      regex.imatch(sender.display_name, ".*#[a-z0-9-#]+$")
26      and not regex.imatch(subject.subject, ".*#[a-z-]+$")
27      and not regex.imatch(subject.subject, ".*#[0-9-]+$")
28    ),
29    any(ml.nlu_classifier(subject.subject).intents,
30        .name == "cred_theft" and .confidence == "high"
31    ),
32    body.current_thread.text is null
33  )
34  
35  // standard negations
36  and not profile.by_sender_email().any_messages_benign
37  and not profile.by_sender_email().solicited
38  and not (
39    sender.email.domain.root_domain in $high_trust_sender_root_domains
40    and coalesce(headers.auth_summary.dmarc.pass, false)
41  )  
42tags:
43 - "Attack surface reduction"
44attack_types:
45  - "Credential Phishing"
46  - "Spam"
47tactics_and_techniques:
48  - "Evasion"
49detection_methods:
50  - "Content analysis"
51  - "Sender analysis"
52id: "e819593d-b60d-5b57-8bf5-837be4111c3f"