From 500df97551938d8e0ef258ca09b30e0798197835 Mon Sep 17 00:00:00 2001 From: Josh Kamdjou Date: Sun, 5 Nov 2023 18:34:50 -0500 Subject: [PATCH] Add sender profile (#917) --- .../recipients_undisclosed_compauth_check.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/detection-rules/recipients_undisclosed_compauth_check.yml b/detection-rules/recipients_undisclosed_compauth_check.yml index bf7b2ffbd88..b09805eb138 100644 --- a/detection-rules/recipients_undisclosed_compauth_check.yml +++ b/detection-rules/recipients_undisclosed_compauth_check.yml @@ -27,6 +27,25 @@ source: | ) ) ) + and ( + profile.by_sender().prevalence in ("new", "outlier") + or ( + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_false_positives + ) + ) + // negate highly trusted sender domains unless they fail DMARC authentication + and ( + ( + sender.email.domain.root_domain in $high_trust_sender_root_domains + and ( + any(distinct(headers.hops, .authentication_results.dmarc is not null), + strings.ilike(.authentication_results.dmarc, "*fail") + ) + ) + ) + or sender.email.domain.root_domain not in $high_trust_sender_root_domains + ) detection_methods: - "Content analysis" - "Computer Vision"