Merge branch 'main' into morriscode-patch-14

.github/workflows/rule-validate.yml

@@ -74,6 +74,11 @@ jobs:
         run: |
           ! /bin/sh -c 'ls **/*.yaml'
 
+          
+      - name: Verify no .yml files exist in the top directory
+        run: |
+          ! /bin/sh -c 'ls *.yml'
+
       - name: Commit & Push Results, if needed
         run: |
           rm response.txt

detection-rules/attachment_adobe_image_lure_qr_code.yml

@@ -80,6 +80,7 @@ source: |
               "adobeprojectm.com",
               "adoberesources.net",
               "adobesc.com",
+              "adobesign.com",
               "adobestock.com",
               "createjs.com",
               "licensingstack.com",
@@ -90,6 +91,19 @@ source: |
             )
     )
   )
+
+  // negate highly trusted sender domains unless they fail DMARC authentication
+  and (
+    (
+      sender.email.domain.root_domain in $high_trust_sender_root_domains
+      and (
+        any(distinct(headers.hops, .authentication_results.dmarc is not null),
+            strings.ilike(.authentication_results.dmarc, "*fail")
+        )
+      )
+    )
+    or sender.email.domain.root_domain not in $high_trust_sender_root_domains
+  )
   
   and (
     not profile.by_sender().solicited

detection-rules/attachment_dropbox_image_suspicious_links.yml

@@ -1,18 +1,24 @@
 name: "Attachment: Dropbox image lure with no Dropbox domains in links"
-description: "Detects Dropbox phishing emails with no dropbox links with image attachments from first time sender."
+description: "Detects Dropbox phishing emails with no Dropbox links with image attachments from first time sender."
 type: "rule"
 severity: "medium"
 source: |
   type.inbound
   and length(filter(attachments, .file_type not in $file_types_images)) == 0
-  and any(body.links, not strings.ilike(.href_url.domain.root_domain, "dropbox.*"))
+  and any(body.links,
+          not strings.ilike(.href_url.domain.root_domain, "dropbox.*")
+  )
   and any(attachments,
           .file_type in $file_types_images
           and any(file.explode(.),
                   strings.ilike(.scan.ocr.raw, "*dropbox*")
                   and strings.ilike(.scan.ocr.raw, "*review*", "*sign*")
           )
   )
+  and (
+    length(headers.references) == 0
+    or not any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
+  )
   and (
     profile.by_sender().prevalence in ("new", "outlier")
     or (

detection-rules/attachment_fake_attachment_image.yml

@@ -0,0 +1,53 @@
+name: "Attachment: Fake attachment image lure"
+description: | 
+  Message body (or attached message body) contains a image faking an Outlook attachment button. The image contains OCR entities that are suspicious.
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and (
+    // fake file attachment preview in original email
+    any(attachments,
+        .file_type in $file_types_images
+        and .size < 5000
+        and any(file.explode(.),
+                any(ml.nlu_classifier(.scan.ocr.raw).entities,
+                    .name in~ ("financial", "urgency")
+                )
+        )
+        and any(attachments,
+                .file_type in $file_types_images
+                and any(ml.logo_detect(.).brands, .name == "FakeAttachment")
+        )
+    )
+    // fake file attachment preview in attached EML
+    or any(attachments,
+           .content_type == "message/rfc822"
+           and any(file.parse_eml(.).attachments,
+                   .file_type in $file_types_images
+                   and .size < 5000
+                   and any(file.explode(.),
+                           any(ml.nlu_classifier(.scan.ocr.raw).entities,
+                               .name in~ ("financial", "urgency")
+                           )
+                   )
+           )
+    )
+  )
+
+tags:
+  - "Suspicious attachment"
+  - "Suspicious content"
+attack_types:
+  - "Credential Phishing"
+  - "Malware/Ransomware"
+tactics_and_techniques:
+  - "Evasion"
+  - "Image as content"
+  - "Social engineering"
+detection_methods:
+  - "EML analysis"
+  - "File analysis"
+  - "Natural Language Understanding"
+  - "Optical Character Recognition"
+id: "96b8b285-2116-5e45-b0ca-57b81dc87b94"

detection-rules/attachment_free_subdomain_suspicious_link_language.yml

@@ -18,6 +18,8 @@ source: |
               any(ml.nlu_classifier(.scan.ocr.raw).intents, .name == "cred_theft" and .confidence != "low")
           )
   )
+tags:
+  - "Attack surface reduction"
 attack_types:
   - "Credential Phishing"
 tactics_and_techniques:

detection-rules/body_extortion.yml

@@ -8,10 +8,12 @@ severity: "low"
 source: |
   type.inbound
   and (
-  any(ml.nlu_classifier(body.current_thread.text).intents,
-      .name == "extortion" and .confidence == "high"
-  )
-  and any(ml.nlu_classifier(body.current_thread.text).entities, .name == "financial")
+    any(ml.nlu_classifier(body.current_thread.text).intents,
+        .name == "extortion" and .confidence == "high"
+    )
+    and any(ml.nlu_classifier(body.current_thread.text).entities,
+            .name == "financial"
+    )
   )
   and (
     (
@@ -22,8 +24,12 @@ source: |
       sender.email.domain.root_domain not in $free_email_providers
       and sender.email.domain.domain not in $sender_domains
     )
+  
     // many extortion emails spoof sender domains and fail sender authentication
-    or any(headers.hops, .authentication_results.dmarc == "fail")
+    or any(headers.hops,
+           .authentication_results.dmarc == "fail"
+           or .authentication_results.compauth.verdict not in ("pass", "softpass")
+    )
   )
 attack_types:
   - "Extortion"

detection-rules/body_microsoft_logo_bing_redirect.yml → detection-rules/body_microsoft_logo_open_redirect.yml

@@ -1,11 +1,11 @@
-name: "Body: Microsoft logo or Suspicious Language and Bing open redirect"
+name: "Body: Microsoft logo or Suspicious Language and an open redirect"
 description: |
   Email contains a Microsoft logo or suspicious terms and use of the Bing open redirect. This has been exploited in the wild to impersonate Microsoft.
 type: "rule"
 severity: "high"
 source: |
   type.inbound
-
+  
   // Microsoft logo
   and (
     any(attachments,
@@ -42,9 +42,11 @@ source: |
            )
     )
   )
-
-  // Bing redirect
-  and any(body.links, .href_url.domain.root_domain == 'bing.com' and .href_url.path =~ '/ck/a')
+  
+  // open redirect
+  and any(body.links,
+          any(.href_url.rewrite.encoders, strings.icontains(., "open_redirect"))
+  )
   and sender.email.domain.root_domain not in $org_domains
   and sender.email.domain.root_domain not in (
     "bing.com",
@@ -57,6 +59,7 @@ source: |
     "sharepointonline.com",
     "yammer.com"
   )
+
 attack_types:
   - "BEC/Fraud"
 tactics_and_techniques: