Skip to content

Commit

Permalink
Fix some html.screenshot usages (#1031)
Browse files Browse the repository at this point in the history
  • Loading branch information
@rw-access
rw-access authored Nov 29, 2023
1 parent 888954b commit c797e4f
Show file tree
Hide file tree
Showing 2 changed files with 27 additions and 65 deletions.
36 changes: 9 additions & 27 deletions detection-rules/attachment_fake_slack_installer.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,37 +12,19 @@ source: |
or .file_type == "html"
or .content_type == "text/html"
)
and any(ml.logo_detect(file.html_screenshot(.)).brands,
.name == "Slack" and .confidence in ("medium", "high")
)
and any(ml.nlu_classifier(file.parse_html(.).display_text).entities,
.name == "request" and .text =~ "download"
)
and any(file.explode(.),
any(ml.logo_detect(file.html_screenshot(..)).brands,
.name == "Slack" and .confidence in ("medium", "high")
)
and any(ml.nlu_classifier(file.parse_html(..).display_text).entities,
.name == "request" and .text =~ "download"
)
and any(.scan.url.urls,
strings.iends_with(.path, ".exe") and .domain.root_domain not in $org_domains
any(.scan.url.urls,
strings.iends_with(.path, ".exe")
and .domain.root_domain not in $org_domains
)
)
)
or any(attachments,
(.file_extension in~ $file_extensions_common_archives)
and any(file.explode(.),
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or ..file_type == "html"
or ..content_type == "text/html"
)
and any(ml.logo_detect(file.html_screenshot(..)).brands,
.name == "Slack" and .confidence in ("medium", "high")
)
and any(ml.nlu_classifier(file.parse_html(..).display_text).entities,
.name == "request" and .text =~ "download"
)
and any(.scan.url.urls,
strings.iends_with(.path, ".exe") and .domain.root_domain not in $org_domains
)
)
)
)
attack_types:
- "Malware/Ransomware"
Expand Down
56 changes: 18 additions & 38 deletions detection-rules/attachment_fake_zoom_installer.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,44 +5,24 @@ type: "rule"
severity: "high"
source: |
type.inbound
and (
any(attachments,
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or .file_type == "html"
or .content_type == "text/html"
)
and any(file.explode(.),
any(ml.logo_detect(file.html_screenshot(..)).brands,
.name == "Zoom" and .confidence in ("medium", "high")
)
and any(ml.nlu_classifier(file.parse_html(..).display_text).entities,
.name == "request" and .text =~ "download"
)
and any(.scan.url.urls,
strings.iends_with(.path, ".exe") and .domain.root_domain not in $org_domains
)
)
)
or any(attachments,
(.file_extension in~ $file_extensions_common_archives)
and any(file.explode(.),
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or ..file_type == "html"
or ..content_type == "text/html"
)
and any(ml.logo_detect(file.html_screenshot(..)).brands,
.name == "Zoom" and .confidence in ("medium", "high")
)
and any(ml.nlu_classifier(file.parse_html(..).display_text).entities,
.name == "request" and .text =~ "download"
)
and any(.scan.url.urls,
strings.iends_with(.path, ".exe") and .domain.root_domain not in $org_domains
)
)
)
and any(attachments,
(
.file_extension in~ ("html", "htm", "shtml", "dhtml")
or .file_type == "html"
or .content_type == "text/html"
)
and any(ml.logo_detect(file.html_screenshot(.)).brands,
.name == "Zoom" and .confidence in ("medium", "high")
)
and any(ml.nlu_classifier(file.parse_html(.).display_text).entities,
.name == "request" and .text =~ "download"
)
and any(file.explode(.),
any(.scan.url.urls,
strings.iends_with(.path, ".exe")
and .domain.root_domain not in $org_domains
)
)
)
attack_types:
- "Malware/Ransomware"
Expand Down

0 comments on commit c797e4f

Please sign in to comment.