detection.wiki

Detection rules › Sublime MQL

Brand impersonation: Microsoft with low reputation links

Severity
medium
Type
rule
Source
github.com/sublime-security/sublime-rules

Detects low reputation links with Microsoft specific indicators in the body.

Threat classification

Sublime's own taxonomy (not MITRE ATT&CK).

CategoryValues
Attack typesCredential Phishing
Tactics and techniquesFree file host, Image as content, Impersonation: Brand, Social engineering

Event coverage

Message attribute
attachments (collection)
body
body.current_thread
body.html
body.links (collection)
body.plain
headers (collection)
headers.auth_summary
headers.domains (collection)
recipients
recipients.to (collection)
sender.email
subject
type

Rule body MQL

type.inbound
and 0 < length(body.links) < 50
// suspicious link
and any(body.links,
        (
          .href_url.domain.tld == "ru"
          or .href_url.domain.root_domain not in $tranco_1m
          or .href_url.domain.domain in $free_file_hosts
          or .href_url.domain.root_domain in $free_file_hosts
          or .href_url.domain.root_domain in $free_subdomain_hosts
          or .href_url.domain.domain in $url_shorteners
          or .href_url.domain.domain in $social_landing_hosts
          // account for URL rewrites
          or (
            any(.href_url.query_params_decoded["domain"],
                strings.parse_domain(.).tld == "ru"
                or strings.parse_domain(.).root_domain not in~ $tranco_1m
                or strings.parse_domain(.).domain in~ $free_file_hosts
                or strings.parse_domain(.).root_domain in~ $free_file_hosts
                or strings.parse_domain(.).root_domain in~ $free_subdomain_hosts
                or strings.parse_domain(.).domain in~ $url_shorteners
                or strings.parse_domain(.).domain in~ $social_landing_hosts
            )
          )
          or 

          // mass mailer link, masks the actual URL
          .href_url.domain.root_domain in (
            "hubspotlinks.com",
            "mandrillapp.com",
            "sendgrid.net",
            "rs6.net"
          )

          // Google AMP redirect
          or (
            .href_url.domain.sld == "google"
            and strings.starts_with(.href_url.path, "/amp/")
          )

          // Recipient email address in link
          or any(body.links,
                 any(recipients.to,
                     strings.icontains(..href_url.url, .email.email)
                     and any(recipients.to, .email.domain.valid)
                 )
          )
          or .href_url.domain.root_domain == "beehiiv.com"
        )

        // exclude sources of potential FPs
        and (
          .href_url.domain.root_domain not in (
            "svc.ms",
            "sharepoint.com",
            "1drv.ms",
            "microsoft.com",
            "aka.ms",
            "msftauthimages.net",
            "office.com",
            "microsoftproject.com"
          )
          or any(body.links, .href_url.domain.domain in $free_file_hosts)
        )
        and .href_url.domain.root_domain not in $org_domains
        and .href_url.domain.valid
)

// not a reply
and (length(headers.references) == 0 or headers.in_reply_to is null)

// Microsoft logo
and (
  any(attachments,
      .file_type in $file_types_images
      and any(ml.logo_detect(.).brands, strings.starts_with(.name, "Microsoft"))
  )
  or strings.istarts_with(strings.replace_confusables(body.current_thread.text),
                          "Microsoft "
  )
  or (
    regex.imatch(strings.replace_confusables(body.current_thread.text),
                 '[\n\s]*[o0O]ff[il1]ce\b.*'
    )
    and not regex.icontains(strings.replace_confusables(body.current_thread.text
                            ),
                            'office (for lease|rent|sale)'
    )
  )
  or any(ml.logo_detect(file.message_screenshot()).brands,
         strings.starts_with(.name, "Microsoft")
  )
  or (
    regex.icontains(body.html.raw,
                    '<table[^>]*>\s*<tbody[^>]*>\s*<tr[^>]*>\s*(<td[^>]*bgcolor="#[0-9A-Fa-f]{6}"[^>]*>\s*&nbsp;\s*</td>\s*){2}\s*</tr>\s*<tr[^>]*>\s*(<td[^>]*bgcolor="#[0-9A-Fa-f]{6}"[^>]*>\s*&nbsp;\s*</td>\s*){2}'
    )
    or regex.icontains(body.html.raw,
                       '<td style="background:\s*rgb\(246,\s*93,\s*53\);\s*height:\d+px;">.*?<td style="background:\s*rgb\(129,\s*187,\s*5\);\s*height:\d+px;">.*?<td style="background:\s*rgb\(4,\s*165,\s*240\);\s*height:\d+px;">.*?<td style="background:\s*rgb\(255,\s*186,\s*7\);\s*height:\d+px;">'
    )
    or 4 of (
      regex.icontains(body.html.raw,
                      '<td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(245, 189, 67\);">.{0,10}</td>'
      ),
      regex.icontains(body.html.raw,
                      '<td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(137, 184, 57\);">.{0,10}</td>'
      ),
      regex.icontains(body.html.raw,
                      '<td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(217, 83, 51\);">.{0,10}</td>'
      ),
      regex.icontains(body.html.raw,
                      '<td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(71, 160, 218\);">.{0,10}</td>'
      )
    )
  )
  or regex.icontains(body.html.raw,
                     '<table[^>]*>\s*<tbody[^>]*>\s*<tr[^>]*>\s*(<td[^>]*bgcolor="#[0-9A-Fa-f]{6}"[^>]*>\s*&nbsp;\s*</td>\s*){2}\s*</tr>\s*<tr[^>]*>\s*(<td[^>]*bgcolor="#[0-9A-Fa-f]{6}"[^>]*>\s*&nbsp;\s*</td>\s*){2}'
  )
  or 3 of (
    regex.icontains(body.html.raw, '.password-expiration'),
    regex.icontains(body.html.raw, 'color: #2672ec;'),
    regex.icontains(body.html.raw, 'M\x{00AD}ic\x{00AD}ro\x{00AD}so\x{00AD}ft')
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(246,\s?93,\s?53\)'),
    regex.icontains(body.html.raw, 'rgb\(129,\s?187,\s?5\)'),
    regex.icontains(body.html.raw, 'rgb\(4,\s?165,\s?240\)'),
    regex.icontains(body.html.raw, 'rgb\(255,\s?186,\s?7\)'),
  )
  or 4 of (
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)red'
    ),
    regex.icontains(body.html.raw, 'rgb\(19,\s?186,\s?132\)'),
    regex.icontains(body.html.raw, 'rgb\(4,\s?166,\s?240\)'),
    regex.icontains(body.html.raw, 'rgb\(255,\s?186,\s?8\)'),
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(245,\s?189,\s?67\)'),
    regex.icontains(body.html.raw, 'rgb\(137,\s?184,\s?57\)'),
    regex.icontains(body.html.raw, 'rgb\(217,\s?83,\s?51\)'),
    regex.icontains(body.html.raw, 'rgb\(71,\s?160,\s?218\)')
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(73,\s?161,\s?232\)'),
    regex.icontains(body.html.raw, 'rgb\(224,\s?92,\s?53\)'),
    regex.icontains(body.html.raw, 'rgb\(139,\s?183,\s?55\)'),
    regex.icontains(body.html.raw, 'rgb\(244,\s?188,\s?65\)')
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(213,\s?56,\s?62\)'),
    regex.icontains(body.html.raw, 'rgb\(0,\s?114,\s?30\)'),
    regex.icontains(body.html.raw, 'rgb\(0,\s?110,\s?173\)'),
    regex.icontains(body.html.raw, 'rgb\(227,\s?209,\s?43\)'),
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(246,\s?93,\s?53\)'),
    regex.icontains(body.html.raw, 'rgb\(129,\s?187,\s?5\)'),
    regex.icontains(body.html.raw, 'rgb\(4,\s?165,\s?240\)'),
    regex.icontains(body.html.raw, 'rgb\(255,\s?186,\s?7\)')
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(242,\s?80,\s?34\)'),
    regex.icontains(body.html.raw, 'rgb\(127,\s?186,\s?0\)'),
    regex.icontains(body.html.raw, 'rgb\(0,\s?164,\s?239\)'),
    regex.icontains(body.html.raw, 'rgb\(255,\s?185,\s?0\)'),
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(243,\s?83,\s?37\)'),
    regex.icontains(body.html.raw, 'rgb\(129,\s?188,\s?6\)'),
    regex.icontains(body.html.raw, 'rgb\(5,\s?166,\s?240\)'),
    regex.icontains(body.html.raw, 'rgb\(255,\s?186,\s?8\)')
  )
  or 4 of (
    regex.icontains(body.html.raw, 'rgb\(243,\s?80,\s?34\)'),
    regex.icontains(body.html.raw, 'rgb\(128,\s?187,\s?3\)'),
    regex.icontains(body.html.raw, 'rgb\(3,\s?165,\s?240\)'),
    regex.icontains(body.html.raw, 'rgb\(255,\s?185,\s?3\)')
  )
  or 4 of (
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?(#)?(FF1940|eb5024|F25022|FF1941|red)'
    ),
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?(#)?(36ba57|3eb55d|7db606|7FBA00|36ba58|green)'
    ),
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?#(04a1d6|04B5F0|05a1e8|00A4EF|01a4ef|04a5f0)'
    ),
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?#(FFCA07|f7b408|FFB900|FFCA08|ffb901|ffba07)'
    ),
  )
  or 4 of (
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?#(f65314|f65d35|49a1e8|E74F23|F35325)'
    ),
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?#(7cbf42|81bb05|e05c35|7AB206|81BC06)'
    ),
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?#(00a4ef|0078d7|8bb737|04a5f0|059EE4|05A6F0)'
    ),
    regex.icontains(body.html.raw,
                    '(background-color:|background:|bgcolor=)(.)?#(ffb900|ffba07|f4bc41|F2B108|FFBA08)'
    ),
  )
  // fuzzy approach
  or 4 of (
    regex.icontains(body.html.raw,
                    'rgb\((2[1-4][0-9]|250),\s?(7[0-9]|8[0-9]|9[0-3]),\s?(3[0-9]|4[0-9]|5[0-3])\)'
    ),
    regex.icontains(body.html.raw,
                    'rgb\((12[0-9]|13[0-9]),\s?(18[0-9]|190),\s?([0-9]|10)\)'
    ),
    regex.icontains(body.html.raw,
                    'rgb\(([0-9]|1[0-5]),\s?(16[0-5]|166),\s?(23[0-9]|240)\)'
    ),
    regex.icontains(body.html.raw,
                    'rgb\((25[0-5]),\s?(18[5-9]|19[0-9]),\s?([0-9]|10)\)'
    )
  )
)

// suspicious content
and (
  // current thread is empty, but an image attachment is branded as microsoft.
  // common in image as content
  (
    body.current_thread.text == ""
    and any(attachments,
            .file_type in $file_types_images
            and any(ml.logo_detect(.).brands,
                    strings.starts_with(.name, "Microsoft")
            )
    )
  )
  or (
    strings.ilike(body.plain.raw,
                  "*password*",
                  "*document*",
                  "*voicemail*",
                  "*cache*",
                  "*fax*",
                  "*storage*",
                  "*quota*",
                  "*message*"
    )
    and strings.ilike(body.plain.raw,
                      "*terminated*",
                      "*review*",
                      "*expire*",
                      "*click*",
                      "*view*",
                      "*exceed*",
                      "*clear*",
                      "*only works*",
                      "*failed*",
                      "*deleted*",
                      "*revalidated*",
                      "*renewal*"
    )
  )
  or (
    any(attachments,
        .file_type in $file_types_images
        and any(file.explode(.),
                strings.ilike(.scan.ocr.raw,
                              "*password*",
                              "*document*",
                              "*voicemail*",
                              "*cache*",
                              "*fax*",
                              "*storage*",
                              "*quota*",
                              "*messages*"
                )
                and strings.ilike(.scan.ocr.raw,
                                  "*terminated*",
                                  "*review*",
                                  "*expire*",
                                  "*click*",
                                  "*view*",
                                  "*exceed*",
                                  "*clear*",
                                  "*only works*",
                                  "*failed*",
                                  "*deleted*"
                )
        )
    )
  )
  or (
    //
    // This rule makes use of a beta feature and is subject to change without notice
    // using the beta feature in custom rules is not suggested until it has been formally released
    //
    strings.ilike(beta.ocr(file.message_screenshot()).text,
                  "*password*",
                  "*document*",
                  "*voicemail*",
                  "*cache*",
                  "*fax*",
                  "*storage*",
                  "*quota*",
                  "*messages*"
    )
    and strings.ilike(beta.ocr(file.message_screenshot()).text,
                      "*terminated*",
                      "*review*",
                      "*expire*",
                      "*click*",
                      "*view*",
                      "*exceed*",
                      "*clear*",
                      "*only works*",
                      "*failed*",
                      "*deleted*",
                      "*revalidated*",
                      "*renewal*"
    )
  )
  or (
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence in~ ("medium", "high")
    )
    or any(attachments,
           .file_type in $file_types_images
           and any(file.explode(.),
                   any(ml.nlu_classifier(.scan.ocr.raw).intents,
                       .name == "cred_theft"
                       and .confidence in ("medium", "high")
                   )
           )
    )
  )
)
and sender.email.domain.root_domain not in (
  "bing.com",
  "microsoft.com",
  "microsoftonline.com",
  "microsoftproject.com",
  "microsoftstoreemail.com",
  "microsoftsupport.com",
  "microsoft365.com",
  "office.com",
  "office365.com",
  "onedrive.com",
  "sharepointonline.com",
  "yammer.com",
)

// negate legitimate Office 365 bouncebacks
and not (
  length(attachments) > 0
  and all(attachments,
          .content_type in ("message/delivery-status", "message/rfc822")
  )
  and (sender.email.local_part in ('postmaster', 'mailer-daemon'))
)

// negate Microsoft "welcome to the X group" notifications
and not (
  headers.auth_summary.dmarc.pass
  and length(attachments) == 6
  and length(filter(attachments,
                    strings.istarts_with(.file_name, "GuestWelcomeEmail")
             )
  ) == 5
  and length(filter(body.links,
                    (
                      .href_url.domain.domain not in (
                        "outlook.office365.com",
                        "aka.ms",
                        "go.microsoft.com"
                      )
                    )
                    and not .href_url.domain.domain == sender.email.domain.domain
             )
  ) == 0
  and subject.subject == strings.replace_confusables(subject.subject)
)

// negate org domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $org_domains
    and (
      not headers.auth_summary.dmarc.pass
      // MS quarantine digest emails from an org domain are router "internally" to MS, therefore, there is no authentication information
      or not (
        headers.auth_summary.dmarc.pass is null
        and all(headers.domains,
                .root_domain in ("outlook.com", "office365.com")
        )
        // typical emails from freemail Outlook accounts are from prod.outlook.com
        and strings.ends_with(headers.message_id, "protection.outlook.com>")
      )
    )
  )
  or sender.email.domain.root_domain not in $org_domains
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
  not profile.by_sender().solicited
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)
and not profile.by_sender().any_messages_benign

// exclude marketing jargon from ms partners
and not regex.icontains(body.current_thread.text,
                        '(schedul(e|ing)|set up).{0,20}(call|meeting|demo|zoom|conversation|time|tool|discussion)|book.{0,10}(meeting|demo|call|slot|time)|connect.{0,12}(with me|phone|email)|my.{0,10}(calendar|cal)|reserve.{0,10}s[pl]ot|break the ice|want to know more?|miss your chance|if you no longer wish|if you no longer want|if you wish to opt out|low-code (development|approach|solution|journey|platform)|(?:invite|virtual).{0,30}(webinar|presentation)'
)

Detection logic

Scope: inbound message.

Detects low reputation links with Microsoft specific indicators in the body.

  1. inbound message
  2. all of:
    • length(body.links) > 0
    • length(body.links) < 50
  3. any of body.links where all hold:
    • any of:
      • .href_url.domain.tld is 'ru'
      • .href_url.domain.root_domain not in $tranco_1m
      • .href_url.domain.domain in $free_file_hosts
      • .href_url.domain.root_domain in $free_file_hosts
      • .href_url.domain.root_domain in $free_subdomain_hosts
      • .href_url.domain.domain in $url_shorteners
      • .href_url.domain.domain in $social_landing_hosts
      • any of .href_url.query_params_decoded['domain'] where any holds:
        • strings.parse_domain(.).tld is 'ru'
        • strings.parse_domain(.).root_domain not in $tranco_1m
        • strings.parse_domain(.).domain in $free_file_hosts
        • strings.parse_domain(.).root_domain in $free_file_hosts
        • strings.parse_domain(.).root_domain in $free_subdomain_hosts
        • strings.parse_domain(.).domain in $url_shorteners
        • strings.parse_domain(.).domain in $social_landing_hosts
      • .href_url.domain.root_domain in ('hubspotlinks.com', 'mandrillapp.com', 'sendgrid.net', 'rs6.net')
      • all of:
        • .href_url.domain.sld is 'google'
        • .href_url.path starts with '/amp/'
      • any of body.links where:
        • any of recipients.to where all hold:
          • strings.icontains(.href_url.url)
          • any of recipients.to where:
            • .email.domain.valid
      • .href_url.domain.root_domain is 'beehiiv.com'
    • any of:
      • .href_url.domain.root_domain not in ('svc.ms', 'sharepoint.com', '1drv.ms', 'microsoft.com', 'aka.ms', 'msftauthimages.net', 'office.com', 'microsoftproject.com')
      • any of body.links where:
        • .href_url.domain.domain in $free_file_hosts
    • .href_url.domain.root_domain not in $org_domains
    • .href_url.domain.valid
  4. any of:
    • length(headers.references) is 0
    • headers.in_reply_to is missing
  5. any of:
    • any of attachments where all hold:
      • .file_type in $file_types_images
      • any of ml.logo_detect(.).brands where:
        • .name starts with 'Microsoft'
    • strings.replace_confusables(body.current_thread.text) starts with 'Microsoft '
    • all of:
      • strings.replace_confusables(body.current_thread.text) matches '[\\n\\s]*[o0O]ff[il1]ce\\b.*'
      • not:
        • strings.replace_confusables(body.current_thread.text) matches 'office (for lease|rent|sale)'
    • any of ml.logo_detect(file.message_screenshot()).brands where:
      • .name starts with 'Microsoft'
    • any of:
      • body.html.raw matches '<table[^>]*>\\s*<tbody[^>]*>\\s*<tr[^>]*>\\s*(<td[^>]*bgcolor="#[0-9A-Fa-f]{6}"[^>]*>\\s*&nbsp;\\s*</td>\\s*){2}\\s*</tr>\\s*<tr[^>]*>\\s*(<td[^>]*bgcolor="#[0-9A-Fa-f]{6}"[^>]*>\\s*&nbsp;\\s*</td>\\s*){2}'
      • body.html.raw matches '<td style="background:\\s*rgb\\(246,\\s*93,\\s*53\\);\\s*height:\\d+px;">.*?<td style="background:\\s*rgb\\(129,\\s*187,\\s*5\\);\\s*height:\\d+px;">.*?<td style="background:\\s*rgb\\(4,\\s*165,\\s*240\\);\\s*height:\\d+px;">.*?<td style="background:\\s*rgb\\(255,\\s*186,\\s*7\\);\\s*height:\\d+px;">'
      • at least 4 of 4: body.html.raw matches any of 4 patterns
        • <td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(245, 189, 67\);">.{0,10}</td>
        • <td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(137, 184, 57\);">.{0,10}</td>
        • <td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(217, 83, 51\);">.{0,10}</td>
        • <td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(71, 160, 218\);">.{0,10}</td>
    • body.html.raw matches '<table[^>]*>\\s*<tbody[^>]*>\\s*<tr[^>]*>\\s*(<td[^>]*bgcolor="#[0-9A-Fa-f]{6}"[^>]*>\\s*&nbsp;\\s*</td>\\s*){2}\\s*</tr>\\s*<tr[^>]*>\\s*(<td[^>]*bgcolor="#[0-9A-Fa-f]{6}"[^>]*>\\s*&nbsp;\\s*</td>\\s*){2}'
    • at least 3 of:
      • body.html.raw matches '.password-expiration'
      • body.html.raw matches 'color: #2672ec;'
      • body.html.raw matches 'M\\x{00AD}ic\\x{00AD}ro\\x{00AD}so\\x{00AD}ft'
    • at least 4 of 4: body.html.raw matches any of 4 patterns
      • rgb\(246,\s?93,\s?53\)
      • rgb\(129,\s?187,\s?5\)
      • rgb\(4,\s?165,\s?240\)
      • rgb\(255,\s?186,\s?7\)
    • at least 4 of 4: body.html.raw matches any of 4 patterns
      • (background-color:|background:|bgcolor=)(.)red
      • rgb\(19,\s?186,\s?132\)
      • rgb\(4,\s?166,\s?240\)
      • rgb\(255,\s?186,\s?8\)
    • at least 4 of 4: body.html.raw matches any of 4 patterns
      • rgb\(245,\s?189,\s?67\)
      • rgb\(137,\s?184,\s?57\)
      • rgb\(217,\s?83,\s?51\)
      • rgb\(71,\s?160,\s?218\)
    • at least 4 of 4: body.html.raw matches any of 4 patterns
      • rgb\(73,\s?161,\s?232\)
      • rgb\(224,\s?92,\s?53\)
      • rgb\(139,\s?183,\s?55\)
      • rgb\(244,\s?188,\s?65\)
    • at least 4 of 4: body.html.raw matches any of 4 patterns
      • rgb\(213,\s?56,\s?62\)
      • rgb\(0,\s?114,\s?30\)
      • rgb\(0,\s?110,\s?173\)
      • rgb\(227,\s?209,\s?43\)
    • at least 4 of 4: body.html.raw matches any of 4 patterns
      • rgb\(246,\s?93,\s?53\)
      • rgb\(129,\s?187,\s?5\)
      • rgb\(4,\s?165,\s?240\)
      • rgb\(255,\s?186,\s?7\)
    • at least 4 of 4: body.html.raw matches any of 4 patterns
      • rgb\(242,\s?80,\s?34\)
      • rgb\(127,\s?186,\s?0\)
      • rgb\(0,\s?164,\s?239\)
      • rgb\(255,\s?185,\s?0\)
    • at least 4 of 4: body.html.raw matches any of 4 patterns
      • rgb\(243,\s?83,\s?37\)
      • rgb\(129,\s?188,\s?6\)
      • rgb\(5,\s?166,\s?240\)
      • rgb\(255,\s?186,\s?8\)
    • at least 4 of 4: body.html.raw matches any of 4 patterns
      • rgb\(243,\s?80,\s?34\)
      • rgb\(128,\s?187,\s?3\)
      • rgb\(3,\s?165,\s?240\)
      • rgb\(255,\s?185,\s?3\)
    • at least 4 of 4: body.html.raw matches any of 4 patterns
      • (background-color:|background:|bgcolor=)(.)?(#)?(FF1940|eb5024|F25022|FF1941|red)
      • (background-color:|background:|bgcolor=)(.)?(#)?(36ba57|3eb55d|7db606|7FBA00|36ba58|green)
      • (background-color:|background:|bgcolor=)(.)?#(04a1d6|04B5F0|05a1e8|00A4EF|01a4ef|04a5f0)
      • (background-color:|background:|bgcolor=)(.)?#(FFCA07|f7b408|FFB900|FFCA08|ffb901|ffba07)
    • at least 4 of 4: body.html.raw matches any of 4 patterns
      • (background-color:|background:|bgcolor=)(.)?#(f65314|f65d35|49a1e8|E74F23|F35325)
      • (background-color:|background:|bgcolor=)(.)?#(7cbf42|81bb05|e05c35|7AB206|81BC06)
      • (background-color:|background:|bgcolor=)(.)?#(00a4ef|0078d7|8bb737|04a5f0|059EE4|05A6F0)
      • (background-color:|background:|bgcolor=)(.)?#(ffb900|ffba07|f4bc41|F2B108|FFBA08)
    • at least 4 of 4: body.html.raw matches any of 4 patterns
      • rgb\((2[1-4][0-9]|250),\s?(7[0-9]|8[0-9]|9[0-3]),\s?(3[0-9]|4[0-9]|5[0-3])\)
      • rgb\((12[0-9]|13[0-9]),\s?(18[0-9]|190),\s?([0-9]|10)\)
      • rgb\(([0-9]|1[0-5]),\s?(16[0-5]|166),\s?(23[0-9]|240)\)
      • rgb\((25[0-5]),\s?(18[5-9]|19[0-9]),\s?([0-9]|10)\)
  6. any of:
    • all of:
      • body.current_thread.text is ''
      • any of attachments where all hold:
        • .file_type in $file_types_images
        • any of ml.logo_detect(.).brands where:
          • .name starts with 'Microsoft'
    • all of:
      • body.plain.raw matches any of 8 patterns
        • *password*
        • *document*
        • *voicemail*
        • *cache*
        • *fax*
        • *storage*
        • *quota*
        • *message*
      • body.plain.raw matches any of 12 patterns
        • *terminated*
        • *review*
        • *expire*
        • *click*
        • *view*
        • *exceed*
        • *clear*
        • *only works*
        • *failed*
        • *deleted*
        • *revalidated*
        • *renewal*
    • any of attachments where all hold:
      • .file_type in $file_types_images
      • any of file.explode(.) where all hold:
        • .scan.ocr.raw matches any of 8 patterns
          • *password*
          • *document*
          • *voicemail*
          • *cache*
          • *fax*
          • *storage*
          • *quota*
          • *messages*
        • .scan.ocr.raw matches any of 10 patterns
          • *terminated*
          • *review*
          • *expire*
          • *click*
          • *view*
          • *exceed*
          • *clear*
          • *only works*
          • *failed*
          • *deleted*
    • all of:
      • beta.ocr(file.message_screenshot()).text matches any of 8 patterns
        • *password*
        • *document*
        • *voicemail*
        • *cache*
        • *fax*
        • *storage*
        • *quota*
        • *messages*
      • beta.ocr(file.message_screenshot()).text matches any of 12 patterns
        • *terminated*
        • *review*
        • *expire*
        • *click*
        • *view*
        • *exceed*
        • *clear*
        • *only works*
        • *failed*
        • *deleted*
        • *revalidated*
        • *renewal*
    • any of:
      • any of ml.nlu_classifier(body.current_thread.text).intents where all hold:
        • .name is 'cred_theft'
        • .confidence in ('medium', 'high')
      • any of attachments where all hold:
        • .file_type in $file_types_images
        • any of file.explode(.) where:
          • any of ml.nlu_classifier(.scan.ocr.raw).intents where all hold:
            • .name is 'cred_theft'
            • .confidence in ('medium', 'high')
  7. sender.email.domain.root_domain not in ('bing.com', 'microsoft.com', 'microsoftonline.com', 'microsoftproject.com', 'microsoftstoreemail.com', 'microsoftsupport.com', 'microsoft365.com', 'office.com', 'office365.com', 'onedrive.com', 'sharepointonline.com', 'yammer.com')
  8. not:
    • all of:
      • length(attachments) > 0
      • all of attachments where:
        • .content_type in ('message/delivery-status', 'message/rfc822')
      • sender.email.local_part in ('postmaster', 'mailer-daemon')
  9. not:
    • all of:
      • headers.auth_summary.dmarc.pass
      • length(attachments) is 6
      • length(filter(attachments, strings.istarts_with(.file_name, 'GuestWelcomeEmail'))) is 5
      • length(filter(body.links, .href_url.domain.domain not in ('outlook.office365.com', 'aka.ms', 'go.microsoft.com') and not .href_url.domain.domain == sender.email.domain.domain)) is 0
      • subject.subject is strings.replace_confusables(subject.subject)
  10. any of:
    • all of:
      • sender.email.domain.root_domain in $org_domains
      • any of:
        • not:
          • headers.auth_summary.dmarc.pass
        • not:
          • all of:
            • headers.auth_summary.dmarc.pass is missing
            • all of headers.domains where:
              • .root_domain in ('outlook.com', 'office365.com')
            • headers.message_id ends with 'protection.outlook.com>'
    • sender.email.domain.root_domain not in $org_domains
  11. any of:
    • all of:
      • sender.email.domain.root_domain in $high_trust_sender_root_domains
      • not:
        • headers.auth_summary.dmarc.pass
    • sender.email.domain.root_domain not in $high_trust_sender_root_domains
  12. any of:
    • not:
      • profile.by_sender().solicited
    • all of:
      • profile.by_sender().any_messages_malicious_or_spam
      • not:
        • profile.by_sender().any_messages_benign
  13. not:
    • profile.by_sender().any_messages_benign
  14. not:
    • body.current_thread.text matches '(schedul(e|ing)|set up).{0,20}(call|meeting|demo|zoom|conversation|time|tool|discussion)|book.{0,10}(meeting|demo|call|slot|time)|connect.{0,12}(with me|phone|email)|my.{0,10}(calendar|cal)|reserve.{0,10}s[pl]ot|break the ice|want to know more?|miss your chance|if you no longer wish|if you no longer want|if you wish to opt out|low-code (development|approach|solution|journey|platform)|(?:invite|virtual).{0,30}(webinar|presentation)'

Inspects: attachments[].content_type, attachments[].file_name, attachments[].file_type, body.current_thread.text, body.html.raw, body.links, body.links[].href_url.domain.domain, body.links[].href_url.domain.root_domain, body.links[].href_url.domain.sld, body.links[].href_url.domain.tld, body.links[].href_url.domain.valid, body.links[].href_url.path, body.links[].href_url.query_params_decoded['domain'], body.links[].href_url.url, body.plain.raw, headers.auth_summary.dmarc.pass, headers.domains, headers.domains[].root_domain, headers.in_reply_to, headers.message_id, headers.references, recipients.to, recipients.to[].email.domain.valid, recipients.to[].email.email, sender.email.domain.domain, sender.email.domain.root_domain, sender.email.local_part, subject.subject, type.inbound. Sensors: beta.ocr, file.explode, file.message_screenshot, ml.logo_detect, ml.nlu_classifier, profile.by_sender, regex.icontains, regex.imatch, strings.ends_with, strings.icontains, strings.ilike, strings.istarts_with, strings.parse_domain, strings.replace_confusables, strings.starts_with. Reference lists: $file_types_images, $free_file_hosts, $free_subdomain_hosts, $high_trust_sender_root_domains, $org_domains, $social_landing_hosts, $tranco_1m, $url_shorteners.

Indicators matched (124)

FieldMatchValue
body.links[].href_url.domain.tldequalsru
body.links[].href_url.domain.root_domainmemberhubspotlinks.com
body.links[].href_url.domain.root_domainmembermandrillapp.com
body.links[].href_url.domain.root_domainmembersendgrid.net
body.links[].href_url.domain.root_domainmemberrs6.net
body.links[].href_url.domain.sldequalsgoogle
strings.starts_withprefix/amp/
body.links[].href_url.domain.root_domainequalsbeehiiv.com
body.links[].href_url.domain.root_domainmembersvc.ms
body.links[].href_url.domain.root_domainmembersharepoint.com
body.links[].href_url.domain.root_domainmember1drv.ms
body.links[].href_url.domain.root_domainmembermicrosoft.com
112 more
body.links[].href_url.domain.root_domainmemberaka.ms
body.links[].href_url.domain.root_domainmembermsftauthimages.net
body.links[].href_url.domain.root_domainmemberoffice.com
body.links[].href_url.domain.root_domainmembermicrosoftproject.com
strings.starts_withprefixMicrosoft
strings.istarts_withprefixMicrosoft
regex.imatchregex[\n\s]*[o0O]ff[il1]ce\b.*
regex.icontainsregexoffice (for lease|rent|sale)
regex.icontainsregex<table[^>]*>\s*<tbody[^>]*>\s*<tr[^>]*>\s*(<td[^>]*bgcolor="#[0-9A-Fa-f]{6}"[^>]*>\s*&nbsp;\s*</td>\s*){2}\s*</tr>\s*<tr[^>]*>\s*(<td[^>]*bgcolor="#[0-9A-Fa-f]{6}"[^>]*>\s*&nbsp;\s*</td>\s*){2}
regex.icontainsregex<td style="background:\s*rgb\(246,\s*93,\s*53\);\s*height:\d+px;">.*?<td style="background:\s*rgb\(129,\s*187,\s*5\);\s*height:\d+px;">.*?<td style="background:\s*rgb\(4,\s*165,\s*240\);\s*height:\d+px;">.*?<td style="background:\s*rgb\(255,\s*186,\s*7\);\s*height:\d+px;">
regex.icontainsregex<td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(245, 189, 67\);">.{0,10}</td>
regex.icontainsregex<td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(137, 184, 57\);">.{0,10}</td>
regex.icontainsregex<td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(217, 83, 51\);">.{0,10}</td>
regex.icontainsregex<td style="width:.\d.px;.height:.\d.px;.background-color:.rgb\(71, 160, 218\);">.{0,10}</td>
regex.icontainsregex.password-expiration
regex.icontainsregexcolor: #2672ec;
regex.icontainsregexM\x{00AD}ic\x{00AD}ro\x{00AD}so\x{00AD}ft
regex.icontainsregexrgb\(246,\s?93,\s?53\)
regex.icontainsregexrgb\(129,\s?187,\s?5\)
regex.icontainsregexrgb\(4,\s?165,\s?240\)
regex.icontainsregexrgb\(255,\s?186,\s?7\)
regex.icontainsregex(background-color:|background:|bgcolor=)(.)red
regex.icontainsregexrgb\(19,\s?186,\s?132\)
regex.icontainsregexrgb\(4,\s?166,\s?240\)
regex.icontainsregexrgb\(255,\s?186,\s?8\)
regex.icontainsregexrgb\(245,\s?189,\s?67\)
regex.icontainsregexrgb\(137,\s?184,\s?57\)
regex.icontainsregexrgb\(217,\s?83,\s?51\)
regex.icontainsregexrgb\(71,\s?160,\s?218\)
regex.icontainsregexrgb\(73,\s?161,\s?232\)
regex.icontainsregexrgb\(224,\s?92,\s?53\)
regex.icontainsregexrgb\(139,\s?183,\s?55\)
regex.icontainsregexrgb\(244,\s?188,\s?65\)
regex.icontainsregexrgb\(213,\s?56,\s?62\)
regex.icontainsregexrgb\(0,\s?114,\s?30\)
regex.icontainsregexrgb\(0,\s?110,\s?173\)
regex.icontainsregexrgb\(227,\s?209,\s?43\)
regex.icontainsregexrgb\(242,\s?80,\s?34\)
regex.icontainsregexrgb\(127,\s?186,\s?0\)
regex.icontainsregexrgb\(0,\s?164,\s?239\)
regex.icontainsregexrgb\(255,\s?185,\s?0\)
regex.icontainsregexrgb\(243,\s?83,\s?37\)
regex.icontainsregexrgb\(129,\s?188,\s?6\)
regex.icontainsregexrgb\(5,\s?166,\s?240\)
regex.icontainsregexrgb\(243,\s?80,\s?34\)
regex.icontainsregexrgb\(128,\s?187,\s?3\)
regex.icontainsregexrgb\(3,\s?165,\s?240\)
regex.icontainsregexrgb\(255,\s?185,\s?3\)
regex.icontainsregex(background-color:|background:|bgcolor=)(.)?(#)?(FF1940|eb5024|F25022|FF1941|red)
regex.icontainsregex(background-color:|background:|bgcolor=)(.)?(#)?(36ba57|3eb55d|7db606|7FBA00|36ba58|green)
regex.icontainsregex(background-color:|background:|bgcolor=)(.)?#(04a1d6|04B5F0|05a1e8|00A4EF|01a4ef|04a5f0)
regex.icontainsregex(background-color:|background:|bgcolor=)(.)?#(FFCA07|f7b408|FFB900|FFCA08|ffb901|ffba07)
regex.icontainsregex(background-color:|background:|bgcolor=)(.)?#(f65314|f65d35|49a1e8|E74F23|F35325)
regex.icontainsregex(background-color:|background:|bgcolor=)(.)?#(7cbf42|81bb05|e05c35|7AB206|81BC06)
regex.icontainsregex(background-color:|background:|bgcolor=)(.)?#(00a4ef|0078d7|8bb737|04a5f0|059EE4|05A6F0)
regex.icontainsregex(background-color:|background:|bgcolor=)(.)?#(ffb900|ffba07|f4bc41|F2B108|FFBA08)
regex.icontainsregexrgb\((2[1-4][0-9]|250),\s?(7[0-9]|8[0-9]|9[0-3]),\s?(3[0-9]|4[0-9]|5[0-3])\)
regex.icontainsregexrgb\((12[0-9]|13[0-9]),\s?(18[0-9]|190),\s?([0-9]|10)\)
regex.icontainsregexrgb\(([0-9]|1[0-5]),\s?(16[0-5]|166),\s?(23[0-9]|240)\)
regex.icontainsregexrgb\((25[0-5]),\s?(18[5-9]|19[0-9]),\s?([0-9]|10)\)
body.current_thread.textequals
strings.ilikesubstring*password*
strings.ilikesubstring*document*
strings.ilikesubstring*voicemail*
strings.ilikesubstring*cache*
strings.ilikesubstring*fax*
strings.ilikesubstring*storage*
strings.ilikesubstring*quota*
strings.ilikesubstring*message*
strings.ilikesubstring*terminated*
strings.ilikesubstring*review*
strings.ilikesubstring*expire*
strings.ilikesubstring*click*
strings.ilikesubstring*view*
strings.ilikesubstring*exceed*
strings.ilikesubstring*clear*
strings.ilikesubstring*only works*
strings.ilikesubstring*failed*
strings.ilikesubstring*deleted*
strings.ilikesubstring*revalidated*
strings.ilikesubstring*renewal*
strings.ilikesubstring*messages*
ml.nlu_classifier(body.current_thread.text).intents[].nameequalscred_theft
ml.nlu_classifier(body.current_thread.text).intents[].confidencemembermedium
ml.nlu_classifier(body.current_thread.text).intents[].confidencememberhigh
ml.nlu_classifier(file.explode(attachments[])[].scan.ocr.raw).intents[].nameequalscred_theft
ml.nlu_classifier(file.explode(attachments[])[].scan.ocr.raw).intents[].confidencemembermedium
ml.nlu_classifier(file.explode(attachments[])[].scan.ocr.raw).intents[].confidencememberhigh
sender.email.domain.root_domainmemberbing.com
sender.email.domain.root_domainmembermicrosoft.com
sender.email.domain.root_domainmembermicrosoftonline.com
sender.email.domain.root_domainmembermicrosoftproject.com
sender.email.domain.root_domainmembermicrosoftstoreemail.com
sender.email.domain.root_domainmembermicrosoftsupport.com
sender.email.domain.root_domainmembermicrosoft365.com
sender.email.domain.root_domainmemberoffice.com
sender.email.domain.root_domainmemberoffice365.com
sender.email.domain.root_domainmemberonedrive.com
sender.email.domain.root_domainmembersharepointonline.com
sender.email.domain.root_domainmemberyammer.com
attachments[].content_typemembermessage/delivery-status
attachments[].content_typemembermessage/rfc822
sender.email.local_partmemberpostmaster
sender.email.local_partmembermailer-daemon
strings.istarts_withprefixGuestWelcomeEmail
body.links[].href_url.domain.domainmemberoutlook.office365.com
body.links[].href_url.domain.domainmemberaka.ms
body.links[].href_url.domain.domainmembergo.microsoft.com
headers.domains[].root_domainmemberoutlook.com
headers.domains[].root_domainmemberoffice365.com
strings.ends_withsuffixprotection.outlook.com>
regex.icontainsregex(schedul(e|ing)|set up).{0,20}(call|meeting|demo|zoom|conversation|time|tool|discussion)|book.{0,10}(meeting|demo|call|slot|time)|connect.{0,12}(with me|phone|email)|my.{0,10}(calendar|cal)|reserve.{0,10}s[pl]ot|break the ice|want to know more?|miss your chance|if you no longer wish|if you no longer want|if you wish to opt out|low-code (development|approach|solution|journey|platform)|(?:invite|virtual).{0,30}(webinar|presentation)