From f5e7b89203ca9d2ea86b35c46000169955f0ea1a Mon Sep 17 00:00:00 2001 From: Aiden Mitchell Date: Wed, 25 Oct 2023 10:57:02 -0700 Subject: [PATCH 1/2] Create attachment_small_html_recipient_address.yml --- ...ttachment_small_html_recipient_address.yml | 56 +++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 detection-rules/attachment_small_html_recipient_address.yml diff --git a/detection-rules/attachment_small_html_recipient_address.yml b/detection-rules/attachment_small_html_recipient_address.yml new file mode 100644 index 00000000000..0f6f243db06 --- /dev/null +++ b/detection-rules/attachment_small_html_recipient_address.yml @@ -0,0 +1,56 @@ +name: "Attachment: HTML smuggling containing recipient email address" +description: "HTML attachment is small and contains a recipients email address." +type: "rule" +severity: "medium" +source: | + type.inbound + and ( + any(attachments, + ( + .file_extension in~ ("html", "htm", "shtml", "dhtml") + or .file_type == "html" + or .content_type == "text/html" + ) + and any(file.explode(.), + .size < 10000 + and length(.scan.strings.strings) < 20 + and any(recipients.to, + any(..scan.strings.strings, strings.icontains(., ..email.email)) + ) + ) + ) + or any(attachments, + (.file_extension in~ $file_extensions_common_archives) + and any(file.explode(.), + ( + .file_extension in~ ("html", "htm", "shtml", "dhtml") + or ..file_type == "html" + or ..content_type == "text/html" + ) + and .size < 10000 + and length(.scan.strings.strings) < 20 + and any(recipients.to, + any(..scan.strings.strings, strings.icontains(., ..email.email)) + ) + ) + ) + ) + // first-time sender + and ( + profile.by_sender().prevalence in ("new", "outlier") + or ( + profile.by_sender().any_messages_malicious_or_spam + and not profile.by_sender().any_false_positives + ) + ) +attack_types: + - "Credential Phishing" + - "Malware/Ransomware" +tactics_and_techniques: + - "Evasion" + - "HTML smuggling" + - "Scripting" +detection_methods: + - "Archive analysis" + - "File analysis" + - "Sender analysis" From 42a5d4d23c8d662424b7fdf91f5d30fd4151252e Mon Sep 17 00:00:00 2001 From: ID Generator Date: Wed, 25 Oct 2023 17:58:00 +0000 Subject: [PATCH 2/2] Auto add rule ID --- detection-rules/attachment_small_html_recipient_address.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detection-rules/attachment_small_html_recipient_address.yml b/detection-rules/attachment_small_html_recipient_address.yml index 0f6f243db06..d22a51ca279 100644 --- a/detection-rules/attachment_small_html_recipient_address.yml +++ b/detection-rules/attachment_small_html_recipient_address.yml @@ -54,3 +54,4 @@ detection_methods: - "Archive analysis" - "File analysis" - "Sender analysis" +id: "af32ff2f-1aa8-5a54-bc50-93648f17cfcd"