Sync from PR#933

New Rule: Link Quickbooks Image lure with suspicious link by @morriscode
#933
Source SHA d96ffce
Triggered by @morriscode

detection-rules/link_quickbooks_image_lure_suspicious_link.yml

@@ -0,0 +1,18 @@
+name: "Link: QuickBooks image lure with suspicious link"
+description: "This rule detects messages with image attachments containing QuickBooks logo containing exactly 1 link to a suspicious URL. "
+type: "rule"
+severity: "medium"
+source: "type.inbound\nand length(attachments) < 3\nand length(body.links) == 1\nand (\n  // body text is very short\n  (\n    0 <= (length(body.current_thread.text)) < 10\n    or body.current_thread.text is null\n  )\n  or (\n    length(body.current_thread.text) < 900\n    // or body is most likely all warning banner (text contains the sender and common warning banner language)\n    and (\n      regex.icontains(body.current_thread.text,\n                      'caution|confidentiality notice|warning'\n      )\n    )\n    and any(attachments,\n            .file_type in $file_types_images\n            and any(ml.logo_detect(.).brands, .name == \"Quickbooks\")\n    )\n  )\n)\n// suspicious link\nand any(body.links,\n        (\n          .href_url.domain.root_domain not in $tranco_1m\n          or .href_url.domain.domain in $free_file_hosts\n          or .href_url.domain.root_domain in $free_subdomain_hosts\n          or .href_url.domain.domain in $url_shorteners\n          or \n\n          // mass mailer link, masks the actual URL\n          .href_url.domain.root_domain in (\n            \"hubspotlinks.com\",\n            \"mandrillapp.com\",\n            \"sendgrid.net\",\n            \"rs6.net\"\n          )\n        )\n\n        // exclude sources of potential FPs\n        and (\n          .href_url.domain.root_domain not in (\n            \"svc.ms\",\n            \"sharepoint.com\",\n            \"1drv.ms\",\n            \"microsoft.com\",\n            \"aka.ms\",\n            \"msftauthimages.net\",\n            \"intuit.com\",\n            \"turbotax.com\",\n            \"intuit.ca\"\n          )\n          or any(body.links, .href_url.domain.domain in $free_file_hosts)\n        )\n        and .href_url.domain.root_domain not in $org_domains\n)\nand sender.email.domain.root_domain not in~ (\n  'intuit.com',\n  'turbotax.com',\n  'intuit.ca'\n)\n\n// negate highly trusted sender domains unless they fail DMARC authentication\nand (\n  (\n    sender.email.domain.root_domain in $high_trust_sender_root_domains\n    and (\n      any(distinct(headers.hops, .authentication_results.dmarc is not null),\n          strings.ilike(.authentication_results.dmarc, \"*fail\")\n      )\n    )\n  )\n  or sender.email.domain.root_domain not in $high_trust_sender_root_domains\n)\n  \n"
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Impersonation: Brand"
+  - "Social engineering"
+detection_methods:
+  - "Computer Vision"
+  - "File analysis"
+  - "Optical Character Recognition"
+  - "URL analysis"
+id: "3826a923-865e-5d87-82e4-0c1f8434efc0"
+testing_pr: 933
+testing_sha: d96ffce8133f7db15622ebcdf5ca4d0314a87fc4