Sender Profiles: Prevalence and Past behavior

detection-rules/attachment_adobe_image_lure_fts.yml

@@ -20,13 +20,10 @@ source: |
           )
   )
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $sender_emails
-    )
+    profile.by_sender().prevalence in ("new", "outlier")
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $sender_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 attack_types:

detection-rules/attachment_any_html_in_archive_unsolicited.yml

@@ -14,13 +14,10 @@ source: |
           and any(file.explode(.), .depth > 0 and .file_extension in~ ("html", "htm"))
   )
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $recipient_emails
-    )
+    not profile.by_sender().solicited
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $recipient_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 tags:

detection-rules/attachment_any_html_new_sender.yml

@@ -14,13 +14,10 @@ source: |
 
   // first-time sender
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $sender_emails
-    )
+    profile.by_sender().prevalence in ("new", "outlier")
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $sender_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 tags:

detection-rules/attachment_any_html_unsolicited.yml

@@ -14,13 +14,10 @@ source: |
 
   // unsolicited
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $recipient_emails
-    )
+    not profile.by_sender().solicited
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $recipient_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 tags:

detection-rules/attachment_callback_phish_with_img.yml

@@ -10,13 +10,10 @@ severity: "high"
 source: |
   type.inbound
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $recipient_emails
-    )
+    not profile.by_sender().solicited
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $recipient_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
   and sender.email.domain.root_domain in $free_email_providers

detection-rules/attachment_callback_phish_with_pdf.yml

@@ -8,13 +8,10 @@ severity: "high"
 source: |
   type.inbound
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $recipient_emails
-    )
+    not profile.by_sender().solicited
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $recipient_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 

detection-rules/attachment_docusign_image_suspicious_links.yml

@@ -26,13 +26,10 @@ source: |
           )
   )
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $sender_emails
-    )
+    profile.by_sender().prevalence in ("new", "outlier")
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $sender_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 attack_types:

detection-rules/attachment_dropbox_image_suspicious_links.yml

@@ -14,13 +14,10 @@ source: |
           )
   )
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $sender_emails
-    )
+    profile.by_sender().prevalence in ("new", "outlier")
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $sender_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 attack_types:

detection-rules/attachment_eml_cred_theft.yml

@@ -32,13 +32,10 @@ source: |
 
   // unsolicited
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $recipient_emails
-    )
+    not profile.by_sender().solicited
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $recipient_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 attack_types:

detection-rules/attachment_eml_with_html_attachment.yml

@@ -43,13 +43,10 @@ source: |
 
   // unsolicited
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $recipient_emails
-    )
+    not profile.by_sender().solicited
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $recipient_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 tags:

detection-rules/attachment_emotet_heavily_padded_doc_in_zip.yml

@@ -19,13 +19,10 @@ source: |
           )
   )
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $sender_emails
-    )
+    profile.by_sender().prevalence in ("new", "outlier")
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $sender_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 tags:

detection-rules/attachment_encrypted_ole_unsolicited.yml

@@ -13,13 +13,10 @@ source: |
           and file.oletools(.).indicators.encryption.exists
   )
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $recipient_emails
-    )
+    not profile.by_sender().solicited
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $recipient_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 attack_types:

detection-rules/attachment_html_attachment_login_page.yml

@@ -70,13 +70,10 @@ source: |
   )
   // Unsolicited
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $recipient_emails
-    )
+    not profile.by_sender().solicited
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $recipient_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 attack_types:

detection-rules/attachment_html_smuggling_double_encoded_zip.yml

@@ -13,13 +13,10 @@ authors:
 source: |
   type.inbound
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $sender_emails
-    )
+    profile.by_sender().prevalence in ("new", "outlier")
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $sender_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
   and any(attachments,

detection-rules/attachment_html_smuggling_microsoft_signin.yml

@@ -25,13 +25,10 @@ source: |
           )
   )
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $recipient_emails
-    )
+    not profile.by_sender().solicited
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $recipient_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
   // allow Microsoft domains just to be safe

detection-rules/attachment_js_file_execution.yml

@@ -17,13 +17,10 @@ source: |
   )
   // first-time sender
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $sender_emails
-    )
+    profile.by_sender().prevalence in ("new", "outlier")
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $sender_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 tags:

detection-rules/attachment_malwarebazaar.yml

@@ -6,13 +6,10 @@ source: |
   type.inbound
   and any(attachments, .sha256 in $abuse_ch_malwarebazaar_sha256_trusted_reporters)
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $sender_emails
-    )
+    profile.by_sender().prevalence in ("new", "outlier")
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $sender_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 tags:

detection-rules/attachment_mht_embedded_vbscript.yml

@@ -17,13 +17,10 @@ source: |
 
   // unsolicited
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $recipient_emails
-    )
+    not profile.by_sender().solicited
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $recipient_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 attack_types:

detection-rules/attachment_microsoft_image_lure_qr_code.yml

@@ -37,13 +37,10 @@ source: |
   )
   // unsolicited
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $recipient_emails
-    )
+    not profile.by_sender().solicited
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $recipient_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 attack_types:

detection-rules/attachment_office365_image.yml

@@ -56,13 +56,10 @@ source: |
   )
   // unsolicited
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $recipient_emails
-    )
+    not profile.by_sender().solicited
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $recipient_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 attack_types:

detection-rules/attachment_office_file_relationship_cred_theft.yml

@@ -23,13 +23,10 @@ source: |
           )
   )
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $sender_emails
-    )
+    profile.by_sender().prevalence in ("new", "outlier")
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $sender_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 attack_types:

detection-rules/attachment_pdf_link_to_dmg.yml

@@ -43,13 +43,10 @@ source: |
 
   // first time sender
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $sender_emails
-    )
+    profile.by_sender().prevalence in ("new", "outlier")
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $sender_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 tags: 

detection-rules/attachment_pdf_linking_to_password_protected_file.yml

@@ -19,13 +19,10 @@ source: |
           )
   )
   and (
-    (
-      sender.email.domain.root_domain in $free_email_providers
-      and sender.email.email not in $sender_emails
-    )
+    profile.by_sender().prevalence in ("new", "outlier")
     or (
-      sender.email.domain.root_domain not in $free_email_providers
-      and sender.email.domain.domain not in $sender_domains
+      profile.by_sender().any_malicious_messages
+      and not profile.by_sender().any_false_positives
     )
   )
 attack_types: