Signals from detection rules, batch 1

signals/attachments/attachment_adobe_image.yml

@@ -0,0 +1,6 @@
+name: "Attachment: Adobe image"
+type: "query"
+source: |
+  any(attachments, .file_type in $file_types_images
+      and any(ml.logo_detect(.).brands, .name == "Adobe" and .confidence in ("high"))
+  )

signals/attachments/attachment_archive_with_chm.yml

@@ -0,0 +1,7 @@
+name: "Attachment: Archive with CHM file"
+type: "query"
+source: |
+  any(attachments,
+      .file_extension in~ $file_extensions_common_archives
+      and any(file.explode(.), .file_extension =~ "chm")
+  )

signals/attachments/attachment_archive_with_exe.yml

@@ -0,0 +1,7 @@
+name: "Attachment: Archive with EXE file"
+type: "query"
+source: |
+  any(attachments,
+      .file_extension in~ $file_extensions_common_archives
+      and any(file.explode(.), any(.flavors.yara, . == "mz_file"))
+  )

signals/attachments/attachment_archive_with_html.yml

@@ -0,0 +1,7 @@
+name: "Attachment: HTML file in archive"
+type: "query"
+source: |
+  any(attachments,
+      .file_extension in~ $file_extensions_common_archives
+      and any(file.explode(.), .depth > 0 and .file_extension in~ ("html", "htm"))
+  )

signals/attachments/attachment_eml.yml

@@ -0,0 +1,6 @@
+name: "Attachment: EML"
+type: "query"
+source: |
+  // reduce FPs by checking count of attachments
+  length(attachments) == 1
+  and any(attachments, .content_type == "message/rfc822")

signals/attachments/attachment_html.yml

@@ -0,0 +1,7 @@
+name: "Attachment: HTML file"
+type: "query"
+source: |
+  any(attachments,
+      .file_extension in~ ("html", "htm", "shtml", "dhtml")
+      or .file_type == "html"
+  )

signals/attachments/attachment_image_suspicious_text.yml

@@ -0,0 +1,15 @@
+name: "Attachment: Image with suspicious text"
+type: "query"
+source: |
+  any(attachments, .file_type in $file_types_images
+      and any(file.explode(.),
+              strings.ilike(.scan.ocr.raw,
+                            "*review*",
+                            "*sign*",
+                            "*view*",
+                            "*completed document*",
+                            "*open agreement*",
+                            "important edocs"
+              )
+      )
+  )

signals/content/brand_docusign.yml

@@ -0,0 +1,4 @@
+name: "Brand: DocuSign"
+type: "query"
+source: |
+  any(ml.logo_detect(beta.message_screenshot()).brands, .name == "DocuSign" and .confidence in ("medium", "high"))

signals/content/brand_dropbox.yml

@@ -0,0 +1,10 @@
+name: "Brand: Dropbox"
+type: "query"
+source: |
+  // todo: dropbox image via logo_detect
+  any(attachments,
+      .file_type in $file_types_images
+      and any(file.explode(.),
+              strings.ilike(.scan.ocr.raw, "*dropbox*")
+      )
+  )

signals/headers/headers_bounce_back.yml

@@ -0,0 +1,8 @@
+name: "Bounce back"
+type: "query"
+source: | 
+  not strings.like(sender.email.local_part, "*postmaster*", "*mailer-daemon*", "*administrator*")
+  and not regex.icontains(subject.subject, "^(undeliverable|read:)")
+  and not any(attachments, .content_type == "message/delivery-status")
+  // if the "References" is in the body of the message, it's probably a bounce
+  and not any(headers.references, strings.contains(body.html.display_text, .))