diff --git a/detection-rules/attachment_adobe_image_lure_fts.yml b/detection-rules/attachment_adobe_image_lure_fts.yml new file mode 100644 index 00000000000..079e2e7154a --- /dev/null +++ b/detection-rules/attachment_adobe_image_lure_fts.yml @@ -0,0 +1,42 @@ +name: "Attachment: Adobe image lure with suspicious link from first time sender" +description: "Detects Adobe phishing messages with an Adobe logo attached, with suspicious link language from a first-time sender." +type: "rule" +severity: "medium" +source: | + type.inbound + and length(filter(attachments, .file_type not in $file_types_images)) == 0 + and length(body.links) > 0 + and all(body.links, .display_text is null) + and any(attachments, + any(ml.logo_detect(.).brands, .name == "Adobe" and .confidence in ("high")) + and any(file.explode(.), + strings.ilike(.scan.ocr.raw, + "*review*", + "*sign*", + "*view*", + "*completed document*", + "*open agreement*" + ) + ) + ) + and ( + profile.by_sender().prevalence in ("new", "outlier") + or ( + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_false_positives + ) + ) +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Image as content" + - "Impersonation: Brand" +detection_methods: + - "Content analysis" + - "Computer Vision" + - "Optical Character Recognition" + - "Sender analysis" + - "URL analysis" +id: "1d7add81-9822-576a-bcae-c4440e75e393" +testing_pr: 815 +testing_sha: aed114f25899ab2d1ff2b5519c78aa177a48fa26 diff --git a/detection-rules/attachment_any_html_in_archive_unsolicited.yml b/detection-rules/attachment_any_html_in_archive_unsolicited.yml new file mode 100644 index 00000000000..a375c145c08 --- /dev/null +++ b/detection-rules/attachment_any_html_in_archive_unsolicited.yml @@ -0,0 +1,33 @@ +name: "Attachment: Any HTML file within archive (unsolicited)" +description: "Recursively scans archives to detect HTML files from unsolicited senders. \n\nHTML files can be used for HTML smuggling and embedded in archives to evade detection.\n" +references: + - "https://twitter.com/executemalware/status/1537569201577156611" +type: "rule" +severity: "medium" +source: | + type.inbound + and any(attachments, + .file_extension in~ $file_extensions_common_archives + and any(file.explode(.), .depth > 0 and .file_extension in~ ("html", "htm")) + ) + and ( + not profile.by_sender().solicited + or ( + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_false_positives + ) + ) +tags: + - "Attack surface reduction" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "HTML smuggling" +detection_methods: + - "Archive analysis" + - "File analysis" +id: "6a67c02c-d405-531e-850a-1722849c5fe4" +testing_pr: 815 +testing_sha: aed114f25899ab2d1ff2b5519c78aa177a48fa26 diff --git a/detection-rules/attachment_any_html_new_sender.yml b/detection-rules/attachment_any_html_new_sender.yml new file mode 100644 index 00000000000..e2c0fdc262b --- /dev/null +++ b/detection-rules/attachment_any_html_new_sender.yml @@ -0,0 +1,32 @@ +name: "Attachment: Any HTML file (first-time sender)" +description: | + Potential HTML smuggling attacks from new senders. + Use if passing HTML files is not normal behavior in your environment. + This rule may be expanded to inspect HTML attachments for suspicious code. +references: + - "https://ired.team/offensive-security/defense-evasion/file-smuggling-with-html-and-javascript" + - "https://sandbox.sublimesecurity.com?id=106315e9-166a-4e0f-946e-88ff6fd5f9fd" +type: "rule" +severity: "medium" +source: | + type.inbound + and any(attachments, .file_extension in~ ('htm', 'html') or .file_type == "html") + + // first-time sender + and ( + profile.by_sender().prevalence in ("new", "outlier") + or ( + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_false_positives + ) + ) +tags: + - "Attack surface reduction" +tactics_and_techniques: + - "HTML smuggling" +detection_methods: + - "HTML analysis" + - "Sender analysis" +id: "57a8f5c5-c4c4-5268-b452-e381dc64ea42" +testing_pr: 815 +testing_sha: aed114f25899ab2d1ff2b5519c78aa177a48fa26 diff --git a/detection-rules/attachment_any_html_unsolicited.yml b/detection-rules/attachment_any_html_unsolicited.yml new file mode 100644 index 00000000000..c4dba5a3911 --- /dev/null +++ b/detection-rules/attachment_any_html_unsolicited.yml @@ -0,0 +1,33 @@ +name: "Attachment: Any HTML file (unsolicited)" +description: | + Potential HTML smuggling attacks in unsolicited messages. + Use if passing HTML files is not normal behavior in your environment. + This rule may be expanded to inspect HTML attachments for suspicious code. +references: + - "https://ired.team/offensive-security/defense-evasion/file-smuggling-with-html-and-javascript" + - "https://sandbox.sublimesecurity.com?id=106315e9-166a-4e0f-946e-88ff6fd5f9fd" +type: "rule" +severity: "low" +source: | + type.inbound + and any(attachments, .file_extension in~ ('htm', 'html') or .file_type == "html") + + // unsolicited + and ( + not profile.by_sender().solicited + or ( + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_false_positives + ) + ) +tags: + - "Attack surface reduction" +tactics_and_techniques: + - "HTML smuggling" +detection_methods: + - "File analysis" + - "HTML analysis" + - "Sender analysis" +id: "ef36763f-917d-5338-b1ac-84047334dce8" +testing_pr: 815 +testing_sha: aed114f25899ab2d1ff2b5519c78aa177a48fa26 diff --git a/detection-rules/attachment_callback_phish_with_img.yml b/detection-rules/attachment_callback_phish_with_img.yml new file mode 100644 index 00000000000..e02fc6c587e --- /dev/null +++ b/detection-rules/attachment_callback_phish_with_img.yml @@ -0,0 +1,66 @@ +name: "Attachment: Callback Phishing solicitation via image file" +description: "A fraudulent invoice/receipt found in an image attachment.\nCallback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. \nThe resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.\n" +type: "rule" +authors: + - twitter: "vector_sec" +severity: "high" +source: | + type.inbound + and ( + not profile.by_sender().solicited + or ( + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_false_positives + ) + ) + and sender.email.domain.root_domain in $free_email_providers + and any(attachments, + .file_type in $file_types_images + and any(file.explode(.), + 4 of ( + strings.icontains(.scan.ocr.raw, "purchase"), + strings.icontains(.scan.ocr.raw, "subscription"), + strings.icontains(.scan.ocr.raw, "antivirus"), + strings.icontains(.scan.ocr.raw, "order"), + strings.icontains(.scan.ocr.raw, "support"), + strings.icontains(.scan.ocr.raw, "receipt"), + strings.icontains(.scan.ocr.raw, "amount"), + strings.icontains(.scan.ocr.raw, "charged"), + strings.icontains(.scan.ocr.raw, "invoice"), + strings.icontains(.scan.ocr.raw, "call"), + strings.icontains(.scan.ocr.raw, "cancel"), + strings.icontains(.scan.ocr.raw, "renew"), + strings.icontains(.scan.ocr.raw, "refund"), + strings.icontains(.scan.ocr.raw, "+1") + ) + ) + and any(file.explode(.), + strings.ilike(.scan.ocr.raw, + "*geek squad*", + "*lifelock*", + "*best buy*", + "*mcafee*", + "*norton*", + "*ebay*", + "*paypal*", + "*secure anywhere*" + ) + ) + ) +attack_types: + - "Callback Phishing" +tactics_and_techniques: + - "Evasion" + - "Free email provider" + - "Out of band pivot" + - "Social engineering" + - "Image as content" +detection_methods: + - "Content analysis" + - "Optical Character Recognition" + - "Sender analysis" + - "URL analysis" + - "Computer Vision" +id: "60acbb36-8ed1-562e-8027-260c2fdf0f04" +testing_pr: 815 +testing_sha: aed114f25899ab2d1ff2b5519c78aa177a48fa26 diff --git a/detection-rules/attachment_callback_phish_with_pdf.yml b/detection-rules/attachment_callback_phish_with_pdf.yml new file mode 100644 index 00000000000..f9bc313dd52 --- /dev/null +++ b/detection-rules/attachment_callback_phish_with_pdf.yml @@ -0,0 +1,21 @@ +name: "Attachment: Callback Phishing solicitation via pdf file" +description: "A fraudulent invoice/receipt found in an single page pdf attachment.\nCallback Phishing is an attempt by an attacker to solicit the victim (recipient) to call a phone number. \nThe resulting interaction could lead to a multitude of attacks ranging from Financial theft, Remote Access Trojan (RAT) Installation or Ransomware Deployment.\n" +type: "rule" +severity: "high" +source: "type.inbound\nand (\n not profile.by_sender().solicited\n or (\n profile.by_sender().any_messages_malicious_or_spam\n and not profile.by_sender().any_false_positives\n )\n)\n\n// single attachment\nand length(attachments) == 1\n\n// sender is freemail\nand sender.email.domain.root_domain in $free_email_providers\n\n// the attachment is a pdf with 1 page, and at least 60 ocr chars\nand any(attachments,\n .file_extension == \"pdf\"\n and any(file.explode(.), .scan.exiftool.page_count == 1)\n and any(file.explode(.), length(.scan.ocr.raw) > 60)\n\n // 4 of the following strings are found \n and any(file.explode(.),\n 4 of (\n strings.icontains(.scan.ocr.raw, \"purchase\"),\n strings.icontains(.scan.ocr.raw, \"payment\"),\n strings.icontains(.scan.ocr.raw, \"transaction\"),\n strings.icontains(.scan.ocr.raw, \"subscription\"),\n strings.icontains(.scan.ocr.raw, \"antivirus\"),\n strings.icontains(.scan.ocr.raw, \"order\"),\n strings.icontains(.scan.ocr.raw, \"support\"),\n strings.icontains(.scan.ocr.raw, \"help line\"),\n strings.icontains(.scan.ocr.raw, \"receipt\"),\n strings.icontains(.scan.ocr.raw, \"invoice\"),\n strings.icontains(.scan.ocr.raw, \"call\"),\n strings.icontains(.scan.ocr.raw, \"helpdesk\"),\n strings.icontains(.scan.ocr.raw, \"cancel\"),\n strings.icontains(.scan.ocr.raw, \"renew\"),\n strings.icontains(.scan.ocr.raw, \"refund\"),\n regex.icontains(.scan.ocr.raw, '\\+\\d')\n )\n )\n\n // 1 of the following strings is found, representing common Callback brands \n and any(file.explode(.),\n 1 of (\n strings.icontains(.scan.ocr.raw, \"geek squad\"),\n strings.icontains(.scan.ocr.raw, \"lifelock\"),\n strings.icontains(.scan.ocr.raw, \"best buy\"),\n strings.icontains(.scan.ocr.raw, \"mcafee\"),\n strings.icontains(.scan.ocr.raw, \"norton\"),\n strings.icontains(.scan.ocr.raw, \"ebay\"),\n strings.icontains(.scan.ocr.raw, \"paypal\"),\n )\n )\n)\n" +attack_types: + - "Callback Phishing" +tactics_and_techniques: + - "Evasion" + - "Free email provider" + - "Out of band pivot" + - "PDF" + - "Social engineering" +detection_methods: + - "Exif analysis" + - "File analysis" + - "Optical Character Recognition" + - "Sender analysis" +id: "ac33f097-af20-554c-b29a-56f21be1b285" +testing_pr: 815 +testing_sha: aed114f25899ab2d1ff2b5519c78aa177a48fa26 diff --git a/detection-rules/attachment_docusign_image_suspicious_links.yml b/detection-rules/attachment_docusign_image_suspicious_links.yml index c91aa98bc7e..cede0e1e03b 100644 --- a/detection-rules/attachment_docusign_image_suspicious_links.yml +++ b/detection-rules/attachment_docusign_image_suspicious_links.yml @@ -26,24 +26,10 @@ source: | ) ) and ( - ( - ( - sender.email.domain.root_domain in $free_email_providers - and sender.email.email not in $sender_emails - ) - or ( - sender.email.domain.root_domain not in $free_email_providers - and sender.email.domain.domain not in $sender_domains - ) - ) + profile.by_sender().prevalence in ("new", "outlier") or ( - sender.email.email in $sender_emails - and any(distinct(headers.hops, .received_spf.verdict is not null), - regex.icontains(.received_spf.verdict, "fail|error") - or any(distinct(headers.hops, .authentication_results.dmarc is not null), - strings.ilike(.authentication_results.dmarc, "*fail") - ) - ) + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_false_positives ) ) attack_types: @@ -60,5 +46,5 @@ detection_methods: - "Sender analysis" - "URL screenshot" id: "814a5694-d626-5bf4-a1ba-a1dbcb625279" -testing_pr: 761 -testing_sha: 6513d69b03e871af705d1e93d672104ee05f1023 +testing_pr: 815 +testing_sha: aed114f25899ab2d1ff2b5519c78aa177a48fa26 diff --git a/detection-rules/attachment_dropbox_image_suspicious_links.yml b/detection-rules/attachment_dropbox_image_suspicious_links.yml new file mode 100644 index 00000000000..a7900651b1c --- /dev/null +++ b/detection-rules/attachment_dropbox_image_suspicious_links.yml @@ -0,0 +1,36 @@ +name: "Attachment: Dropbox image lure with no Dropbox domains in links" +description: "Detects Dropbox phishing emails with no dropbox links with image attachments from first time sender." +type: "rule" +severity: "medium" +source: | + type.inbound + and length(filter(attachments, .file_type not in $file_types_images)) == 0 + and any(body.links, not strings.ilike(.href_url.domain.root_domain, "dropbox.*")) + and any(attachments, + .file_type in $file_types_images + and any(file.explode(.), + strings.ilike(.scan.ocr.raw, "*dropbox*") + and strings.ilike(.scan.ocr.raw, "*review*", "*sign*") + ) + ) + and ( + profile.by_sender().prevalence in ("new", "outlier") + or ( + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_false_positives + ) + ) +attack_types: + - "Credential Phishing" +tactics_and_techniques: + - "Impersonation: Brand" + - "Social engineering" +detection_methods: + - "Content analysis" + - "File analysis" + - "Header analysis" + - "Optical Character Recognition" + - "Sender analysis" +id: "500eee2d-d793-5450-a87f-825ce27c897d" +testing_pr: 815 +testing_sha: aed114f25899ab2d1ff2b5519c78aa177a48fa26 diff --git a/detection-rules/attachment_eml_with_html_attachment.yml b/detection-rules/attachment_eml_with_html_attachment.yml new file mode 100644 index 00000000000..ac00005f3cf --- /dev/null +++ b/detection-rules/attachment_eml_with_html_attachment.yml @@ -0,0 +1,68 @@ +name: "Attachment: EML file with HTML attachment (unsolicited)" +description: | + Detects HTML files in EML attachments from unsolicited senders. + + Reduces attack surface against HTML smuggling. +type: "rule" +severity: "medium" +source: | + type.inbound + + // has EML attachment + and any(attachments, + .content_type == "message/rfc822" + and any(file.explode(.), + + // HTML file inside EML attachment + // we've seen files named ".htm.", which results in an empty + // .file_extension, so instead we look at .file_name + // they should be rare enough in EML attachments to not cause + // extraneous FPs + strings.ilike(.file_name, "*htm*") + + // optional: we can add additional signals here if necessary + // identify at least one additional suspicious signal in the message + // and ( + // // html smuggling signals + // any(.scan.javascript.identifiers, . == "unescape") or + // any(.scan.strings.strings, regex.icontains(., "eval")) or + // // more signals here if needed + + // // commonly abused sender TLD + // strings.ilike(sender.email.domain.tld, "*.jp") + // ) + ) + ) + + // exclude bounce backs & read receipts + and not strings.like(sender.email.local_part, "*postmaster*", "*mailer-daemon*", "*administrator*") + and not regex.icontains(subject.subject, "^(undeliverable|read:)") + and not any(attachments, .content_type == "message/delivery-status") + // if the "References" is in the body of the message, it's probably a bounce + and not any(headers.references, strings.contains(body.html.display_text, .)) + + // unsolicited + and ( + not profile.by_sender().solicited + or ( + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_false_positives + ) + ) +tags: + - "Attack surface reduction" +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "HTML smuggling" +detection_methods: + - "Content analysis" + - "File analysis" + - "Header analysis" + - "HTML analysis" + - "Sender analysis" +id: "c24fd191-1685-5cb8-83ef-618225401332" +testing_pr: 815 +testing_sha: aed114f25899ab2d1ff2b5519c78aa177a48fa26 diff --git a/detection-rules/attachment_emotet_heavily_padded_doc_in_zip.yml b/detection-rules/attachment_emotet_heavily_padded_doc_in_zip.yml new file mode 100644 index 00000000000..9e0bb9fe0b1 --- /dev/null +++ b/detection-rules/attachment_emotet_heavily_padded_doc_in_zip.yml @@ -0,0 +1,40 @@ +name: "Attachment: Emotet heavily padded doc in zip file" +description: "Detects a potential Emotet delivery method using padded .doc files that compress into small zip files. \nContents may include Red Dawn templates exceeding 500MB.\n" +references: + - "https://twitter.com/Cryptolaemus1/status/1633099154623803394" +type: "rule" +severity: "high" +source: | + type.inbound + and any(attachments, + .file_extension == "zip" + and any(file.explode(.), + .depth == 0 + and .size < 1000000 + and not .depth > 0 + and strings.ends_with(.scan.exiftool.zip_file_name, ".doc") + and .scan.exiftool.zip_uncompressed_size > 500000000 + ) + ) + and ( + profile.by_sender().prevalence in ("new", "outlier") + or ( + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_false_positives + ) + ) +tags: + - "Malfam: Emotet" +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" +detection_methods: + - "Archive analysis" + - "Content analysis" + - "Exif analysis" + - "File analysis" + - "Sender analysis" +id: "9a5332ed-0023-5d6e-89d3-bd789c3bde6f" +testing_pr: 815 +testing_sha: aed114f25899ab2d1ff2b5519c78aa177a48fa26 diff --git a/detection-rules/attachment_encrypted_ole_unsolicited.yml b/detection-rules/attachment_encrypted_ole_unsolicited.yml new file mode 100644 index 00000000000..83807c78689 --- /dev/null +++ b/detection-rules/attachment_encrypted_ole_unsolicited.yml @@ -0,0 +1,35 @@ +name: "Attachment: Encrypted Microsoft Office file (unsolicited)" +description: | + Encrypted OLE2 (eg Microsoft Office) attachment from an unsolicited sender. Attachment encryption is a common technique used to bypass malware scanning products. + Use if receiving encrypted attachments is not normal behavior in your environment. +references: + - "https://www.cyren.com/blog/articles/anatomy-of-an-attack-password-protected-files-attached-to-emails" +type: "rule" +severity: "high" +source: | + type.inbound + and any(attachments, + .file_extension in~ $file_extensions_macros + and file.oletools(.).indicators.encryption.exists + ) + and ( + not profile.by_sender().solicited + or ( + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_false_positives + ) + ) +attack_types: + - "Malware/Ransomware" +tactics_and_techniques: + - "Encryption" + - "Macros" + - "Scripting" +detection_methods: + - "Archive analysis" + - "File analysis" + - "OLE analysis" + - "Sender analysis" +id: "1e47e953-576c-5ba9-b84e-b72a1a89de87" +testing_pr: 815 +testing_sha: aed114f25899ab2d1ff2b5519c78aa177a48fa26 diff --git a/detection-rules/attachment_html_attachment_login_page.yml b/detection-rules/attachment_html_attachment_login_page.yml index 98775e1f75c..a961f330e31 100644 --- a/detection-rules/attachment_html_attachment_login_page.yml +++ b/detection-rules/attachment_html_attachment_login_page.yml @@ -9,89 +9,7 @@ type: "rule" severity: "medium" authors: - twitter: "ajpc500" -source: | - type.inbound - and any(attachments, - ( - .file_extension in~ ("html", "htm", "shtml", "dhtml") - or .file_extension in~ $file_extensions_common_archives - or .file_type == "html" - ) - and any(file.explode(.), - // suspicious strings found in javascript - ( - length(filter(.scan.javascript.strings, strings.ilike(., "*password*", ))) >= 2 - and 2 of ( - any(.scan.javascript.strings, strings.ilike(., "*incorrect*")), - any(.scan.javascript.strings, strings.ilike(., "*invalid*")), - any(.scan.javascript.strings, strings.ilike(., "*login*")), - any(.scan.javascript.strings, regex.icontains(., "sign.in")), - ) - ) - or ( - // suspicious strings found outside of javascript, but binexplode'd file still of HTML type - length(filter(.scan.strings.strings, strings.ilike(., "*password*", ))) >= 2 - and 2 of ( - any(.scan.strings.strings, strings.ilike(., "*incorrect*")), - any(.scan.strings.strings, strings.ilike(., "*invalid*")), - any(.scan.strings.strings, strings.ilike(., "*login*")), - any(.scan.strings.strings, strings.ilike(., "*