Sublime MQL rules: suspicious

type.inbound
// Headers are in the body.plain.raw but not the body.html.raw
and 2 of (
  strings.icontains(body.plain.raw, "Delivered-To:")
  and not strings.icontains(body.html.raw, "Delivered-To:"),
  strings.icontains(body.plain.raw, "X-Google-Smtp-Source:")
  and not strings.icontains(body.html.raw, "X-Google-Smtp-Source:"),
  strings.icontains(body.plain.raw, "ARC-Seal: i=")
  and not strings.icontains(body.html.raw, "ARC-Seal: i="),
)
and 1 of (
  regex.icontains(body.plain.raw, "Received: by .{10,80} with SMTP id")
  and not regex.icontains(body.html.raw, "Received: by .{10,80} with SMTP id"),
  regex.icontains(body.plain.raw, "X-Received: by .{10,80} with SMTP id")
  and not regex.icontains(body.html.raw, "X-Received: by .{10,80} with SMTP id"),
)
// Negate legitimate forwards where users intentionally include headers
and not (
  (length(headers.references) > 0 or headers.in_reply_to is not null)
  and (subject.is_forward or subject.is_reply)
  and length(body.previous_threads) >= 1
)
// Sender is not from org or high trust domains
and sender.email.domain.root_domain not in $org_domains
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
// contains at least 1 link
and length(body.links) > 0
and 3 of (
  strings.ilike(body.current_thread.text, "*(1)*"),
  strings.ilike(body.current_thread.text, "*waiting for delivery*"),
  strings.ilike(body.current_thread.text, "*delivery missed*"),
  strings.ilike(body.current_thread.text, "*tracking number*")
)

// urgent/time-sensitive language
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "urgency"
)

// email is not personalized with recipients name
and any(recipients.to,
        any(ml.nlu_classifier(body.current_thread.text).entities,
            .text == ..email.local_part
        )
)

type.inbound

// RFP/RFQ language
and 1 of (
  regex.icontains(body.current_thread.text, '(discuss.{0,15}purchas(e|ing))'),
  regex.icontains(body.current_thread.text,
                  '(sign(ed?)|view).{0,10}(purchase order)|Request for a Quot(e|ation)'
  ),
  regex.icontains(body.current_thread.text, '(please|kindly).{0,30}quote'),
  regex.icontains(subject.subject,
                  '(request for (purchase|quot(e|ation))|\bRFQ\b|\bRFP\b)'
  ),
  any(attachments,
      regex.icontains(.file_name, "(purchase.?order|Quot(e|ation))")
  ),
  any(ml.nlu_classifier(body.current_thread.text).entities, .name == "request")
  and any(ml.nlu_classifier(body.current_thread.text).entities,
          .name == "urgency"
  ),
  any(ml.nlu_classifier(body.current_thread.text).tags,
      .name == "purchase_order" and .confidence == "high"
  )
)

// HTML smuggling
and any(attachments,
        (
          .file_extension in~ ("html", "htm", "shtml", "dhtml")
          or .file_extension in~ $file_extensions_common_archives
          or .file_type == "html"
        )
        and any(file.explode(.),
                (
                  length(filter(.scan.javascript.identifiers,
                                strings.like(., "document", "write", "atob")
                         )
                  ) == 3
                  // usage: document['write'](atob)
                  or any(.scan.strings.strings,
                         strings.ilike(., "*document*write*atob*")
                  )
                  // usage: some_var = atob();
                  or any(.scan.strings.strings, strings.ilike(., "*=*atob*;"))
                  // usage: obfuscating "atob"
                  or any(.scan.javascript.identifiers,
                         strings.ilike(., '*ato\u0062*')
                  )
                  // usage: document.head.insertAdjacentHTML("beforeend", atob(...
                  or any(.scan.strings.strings,
                         strings.ilike(.,
                                       "*document*write*atob*",
                                       "*document*insertAdjacentHTML*atob*"
                         )
                  )
                )
        )
)

type.inbound
and (
  (
    (
      length(recipients.to) == 0
      or all(recipients.to,
             .display_name in (
               "Undisclosed recipients",
               "undisclosed-recipients"
             )
      )
    )
    and length(recipients.cc) == 0
  )
  or (
    sender.email.domain.root_domain in $free_email_providers
    and any(headers.reply_to, .email.email != sender.email.email)
    and any(headers.reply_to, .email.email not in $recipient_emails)
  )
  or (
    length(headers.reply_to) > 0
    and all(headers.reply_to,
            .email.domain.root_domain != sender.email.domain.root_domain
            and not .email.domain.root_domain in $org_domains
    )
  )
  or (
    length(recipients.to) == 1
    and all(recipients.to, .email.email == sender.email.email)
    and (length(recipients.cc) > 0 or length(recipients.bcc) > 0)
  )
  or (
    length(recipients.to) == 0
    and length(recipients.cc) == 1
    and sender.email.email == recipients.cc[0].email.email
  )
  or (
    length(recipients.to) == 1
    and length(recipients.cc) == 0
    and sender.email.email == recipients.to[0].email.email
  )
)
and (
  // Group the keyword patterns that specifically indicate RFQ/RFP
  (
    (
      // RFQ/RFP specific language patterns
      regex.icontains(body.current_thread.text,
                      '(discuss.{0,15}purchas(e|ing))'
      )
      or regex.icontains(body.current_thread.text,
                         '(sign(ed?)|view).{0,10}(purchase order)|Request for (a Quot(e|ation)|Proposal)'
      )
      or regex.icontains(body.current_thread.text,
                         '(please|kindly|preferred).{0,30}(?:proposal|quot(e|ation))'
      )
      or regex.icontains(subject.subject,
                         '(request for (purchase|quot(e|ation))|\bRFQ\b|\bRFP\b|bid invit(e|ation))'
      )
      or any(attachments,
             regex.icontains(.file_name, "(purchase.?order|Quot(e|ation))")
      )
      or any(ml.nlu_classifier(body.current_thread.text).tags,
             .name == "purchase_order" and .confidence == "high"
      )
      or any(ml.nlu_classifier(body.current_thread.text).entities,
             .name == "financial" and regex.imatch(.text, "rfp|rfq")
      )
      or any(ml.nlu_classifier(body.current_thread.text).entities,
             .name == "request" and strings.icontains(.text, 'submit bid')
      )
    )
    // Required: at least one RFQ/RFP keyword pattern

    // Optional: at least one additional indicator (can be another keyword pattern or a non-keyword indicator)
    and (
      2 of (
        // RFQ/RFP keyword patterns (same as above)
        regex.icontains(body.current_thread.text,
                        '(discuss.{0,15}purchas(e|ing))'
        ),
        regex.icontains(body.current_thread.text,
                        '(sign(ed?)|view).{0,10}(purchase order)|Request for a Quot(e|ation)'
        ),
        regex.icontains(body.current_thread.text,
                        '(please|kindly|preferred).{0,30}(?:proposal|quot(e|ation))'
        ),
        regex.icontains(body.current_thread.text,
                        '(?:invitation|intent) to bid'
        ),
        regex.icontains(subject.subject,
                        '(request for (purchase|quot(e|ation))|\bRFQ\b|\bRFP\b|bid invit(e|ation))'
        ),
        any(attachments,
            regex.icontains(.file_name, "(purchase.?order|Quot(e|ation))")
        ),
        any(ml.nlu_classifier(body.current_thread.text).tags,
            .name == "purchase_order" and .confidence == "high"
        ),
        any(ml.nlu_classifier(body.current_thread.text).entities,
            .name == "financial" and regex.imatch(.text, "(?:rfp|rfq)")
        ),
        any(attachments,
            any(file.explode(.),
                any(ml.nlu_classifier(.scan.ocr.raw).entities,
                    .name == "request"
                    and regex.imatch(.text, "view (?:rfp|rfq)")
                )
            )
        ),

        // Non-keyword indicators
        (
          any(ml.nlu_classifier(body.current_thread.text).entities,
              .name == "request"
          )
          and any(ml.nlu_classifier(body.current_thread.text).entities,
                  .name == "urgency"
          )
          and not any(ml.nlu_classifier(body.current_thread.text).topics,
                      .name == "Advertising and Promotions"
                      and .confidence == "high"
          )
        ),
        (
          0 < length(filter(body.links,
                            (
                              .href_url.domain.domain in $free_subdomain_hosts
                              or .href_url.domain.domain in $free_file_hosts
                              or network.whois(.href_url.domain).days_old < 30
                            )
                            and (
                              regex.match(.display_text, '[A-Z ]+')
                              or any(ml.nlu_classifier(.display_text).entities,
                                     .name in ("request", "urgency")
                              )
                              or any(ml.nlu_classifier(.display_text).intents,
                                     .name in ("cred_theft")
                              )
                            )
                     )
          ) < 3
        ),
        // mentions an attachment that does not exist
        (
          length(attachments) == 0
          and strings.icontains(body.current_thread.text, "attached")
        ),
        any(body.current_thread.links, regex.icontains(.href_url.url, 'RFP'))
      )
    )
  )
  or (
    length(attachments) == 1
    and length(body.current_thread.text) < 100
    and all(attachments,
            .file_type in $file_types_images
            and any(file.explode(.),
                    2 of (
                      regex.icontains(.scan.ocr.raw,
                                      '(discuss.{0,15}purchas(e|ing))'
                      ),
                      regex.icontains(.scan.ocr.raw,
                                      '(sign(ed?)|view).{0,10}(purchase order)|Request for a Quot(e|ation)'
                      ),
                      regex.icontains(.scan.ocr.raw,
                                      '(please|kindly).{0,30}quote'
                      ),
                      (
                        any(ml.nlu_classifier(.scan.ocr.raw).entities,
                            .name == "request"
                        )
                        and any(ml.nlu_classifier(.scan.ocr.raw).entities,
                                .name == "urgency"
                        )
                      ),
                      any(ml.nlu_classifier(.scan.ocr.raw).tags,
                          .name == "purchase_order" and .confidence == "high"
                      ),
                      any(ml.nlu_classifier(.scan.ocr.raw).entities,
                          .name == "financial"
                          and regex.imatch(.text, "rfp|rfq")
                      ),
                    )
            )
    )
  )
  // fake PDF file icon used as a link lure with bid solicitation language
  or (
    regex.icontains(subject.subject, 'project\s+summary')
    and any(html.xpath(body.html, '//div[.//img[contains(@src,"pdf")]]//a').nodes,
            regex.icontains(.display_text, 'project\s+summary')
    )
    and regex.icontains(body.current_thread.text,
                        '(put a bid|\bbid\s+(for|on)\b|submit.{1,20}(bid|quot(e|ation))|request for (purchase|quot(e|ation))|\bRFQ\b|\bRFP\b|project\s+summary)'
    )
  )
)
// wetransfer includes user specific reply-to's & link display text which triggers NLU logic further within the rule
and not (
  sender.email.domain.root_domain == "wetransfer.com"
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
  (
    (
      not profile.by_sender().solicited
      or profile.by_sender().days_since.last_contact > 30
    )
    and not profile.by_sender().any_messages_benign
  )
  // sender address listed as a recipient
  or (
    length(recipients.to) == 1
    and sender.email.email in map(recipients.to, .email.email)
  )
)

type.inbound

// Suspicious recipient pattern
and any(recipients.to, .display_name == "Undisclosed recipients")
and strings.ilike(body.current_thread.text,
                  "*shared a file with you*",
                  "*shared with you*",
                  "*invited you to access a file*"
)
and strings.icontains(subject.subject, "shared")
and any(body.links, .href_url.domain.root_domain == "sharepoint.com")

type.inbound
and any(regex.iextract(subject.subject,
                       '[^a-z0-9](?P<string>[a-z0-9]{32,64})(?:$|[^a-z0-9])'
        ),
        strings.contains(sender.display_name, .named_groups["string"])
)

type.inbound
and length(attachments) > 1
and all(attachments, .file_type == "pdf")
and (
  length(distinct(attachments, .file_name)) == 1
  or length(distinct(attachments, .md5)) == 1
)
and all(attachments,
        .file_type == "pdf"
        and all(file.explode(.),
                (
                  length(.scan.url.urls) == 0
                  or length(.scan.pdf.urls) == 0
                  or length(body.links) == 0
                )
                and .scan.ocr.raw is null
        )
)

type.inbound
and any(body.links,
        (
          (
            .href_url.domain.root_domain not in $tranco_1m
            and .href_url.domain.valid
            and .href_url.domain.root_domain not in $org_domains
            and .href_url.domain.root_domain not in $high_trust_sender_root_domains
          )
          or .href_url.domain.tld in $suspicious_tlds
        )
        and (
          ml.link_analysis(.).credphish.contains_login
          and (
            ml.link_analysis(.).final_dom.display_text != strings.replace_confusables(ml.link_analysis(.
                                                                                      ).final_dom.display_text
            )
            or length(ml.link_analysis(.).redirect_history) > 1
          )
        )
)
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name in ("financial", "urgency")
)
and (
  (
    length(recipients.to) == 0
    or length(recipients.bcc) > 0
    or (
      all(recipients.to, .email.domain.valid == false)
      and all(recipients.cc, .email.domain.valid == false)
    )
  )
)
and all(body.links,
        .href_url.domain.root_domain != sender.email.domain.root_domain
)

type.inbound
and length(attachments) <= 1
and length(recipients.to) <= 2
// suspicious sender
and (
  (
    length(headers.reply_to) > 0
    and all(headers.reply_to,
            .email.domain.root_domain != sender.email.domain.root_domain
            and .email.domain.root_domain not in $org_domains
    )
  )
  or sender.email.domain.root_domain in $free_email_providers
  or profile.by_sender().days_known < 3
)
// specific financial language
and (
  regex.icontains(subject.subject,
                  '\b(Aged|Age?ing) (Payables|Receivables|Report)',
                  'reconcill?iation (report|statement).*(issued (settlement|advice)s?)|billing records?'
  )
  or (
    regex.icontains(body.current_thread.text,
                    '\b(Aged|Age?ing) (?:Collection|Payables|Receivables|Report)',
                    '(latest|updated|recent) (\bAR\b|\b\AP\b|\bAR\b \& \bAP\b|accounts?) (?:Aging|Payables|Receivables|Reports)',
                    '(shared?|send|forward|provide).*remittance (advice|receipts?|statements?)'
    )
    or strings.icontains(body.current_thread.text,
                         "copy of a current statement"
    )
    or (
      strings.icontains(body.current_thread.text, "please send all past due")
      and strings.icontains(body.current_thread.text, "current invoices")
    )
  )
  // suspicious link display text
  or (
    any(body.links,
        regex.icontains(.display_text,
                        '(Payment|Remittance|Settlement|Transfer) ?Batch',
        )
    )
  )
  // suspicious sender display name
  or (
    regex.icontains(sender.display_name,
                    'Accounts? (?:Payable (?:Dep(\.|t\.?|artment)|e?Receipt)|(Co[[:punct:]]?ordinator|Admin|Manager|Payee))'
    )
    // sender email listed as a recipient or recipients undisclosed/null
    and (
      (
        sender.email.email in map(recipients.to, .email.email)
        or (length(recipients.to) == 0 or length(recipients.to) is null)
      )
      // non-benign nlu intent
      or any(ml.nlu_classifier(body.current_thread.text).intents,
             .name != "benign"
      )
    )
  )
  or (
    any(ml.nlu_classifier(body.current_thread.text).intents,
        .name == "cred_theft" and .confidence == "high"
    )
    and any(ml.nlu_classifier(body.current_thread.text).entities,
            .name == "financial" and .text =~ "remittance"
    )
  )
)
// negate resume related/job inquiry outreach
and not (
  any(ml.nlu_classifier(body.current_thread.text).topics,
      .name == "Professional and Career Development" and .confidence == "high"
  )
  and any(ml.nlu_classifier(body.current_thread.text).intents,
          .name == "benign" and .confidence != "low"
  )
)
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender().any_messages_benign

type.inbound
and regex.icontains(sender.display_name, '\b[\w\p{L}\p{N}]{35,}\b')
and not regex.icontains(sender.display_name, '_bot_[a-f0-9]{32}\)')
and not regex.match(sender.display_name, '\b[\w\p{L}\p{N}]{35,}\b')
and not (sender.email.email == "" or sender.email.domain.valid == false)
// negate org domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $org_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $org_domains
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and not profile.by_sender_email().any_messages_benign

type.inbound

// Matches the message id observed. DKIM/SPF domains can be custom and therefore are unpredictable.
and strings.starts_with(headers.message_id, '<Share-')
and strings.ends_with(headers.message_id, '@odspnotify>')

// SharePoint email indicators
and strings.like(body.current_thread.text,
                 "*shared a file with you*",
                 "*shared with you*",
                 "*invited you to access a file*"
)
and strings.icontains(subject.subject, "shared")

// sender analysis 
and (
  (
    // if the sender is not the sharepointonline.com, we can use the sender email
    // to see if it is a solicited email
    sender.email.domain.domain != "sharepointonline.com"
    and not profile.by_sender().solicited
  )
  // if it is the sharepointonline sender, use the reply-to header
  or (
    sender.email.domain.domain =~ "sharepointonline.com"
    and length(headers.reply_to) > 0
    and 
    // a newly created domain
    (
      all(headers.reply_to,
          .email.domain.root_domain not in $free_email_providers
          and network.whois(.email.domain).days_old <= 30
          and .email.email != sender.email.email
      )

      // is a free email provider
      or all(headers.reply_to,
             .email.domain.root_domain in $free_email_providers
      )

      //
      // This rule makes use of a beta feature and is subject to change without notice
      // using the beta feature in custom rules is not suggested until it has been formally released
      //
      
      // no outbound emails 
      or not beta.profile.by_reply_to().solicited
    )
    // do not match if the reply_to address has been observed as a reply_to address
    // of a message that has been classified as benign
    and not beta.profile.by_reply_to().any_messages_benign
  )
)
// link logic
and any(body.links,
        .href_url.domain.root_domain == "sharepoint.com"
        // it is a personal share
        and (
          // /g/ is only found with /personal
          strings.icontains(.href_url.path, '/g/personal/')
          or strings.icontains(.href_url.path, '/p/')
        )
        // it is either a OneNote or PDF
        and (
          strings.icontains(.href_url.path, '/:o:/')
          or strings.icontains(.href_url.path, '/:b:/')
          or strings.icontains(.href_url.path, '/:u:/')
        )
)

type.inbound
// "#" symbol, and then letters, numbers or more symbols (-#)
and regex.imatch(subject.subject, ".*#[a-z0-9-#]+$")
// not JUST letters
and not regex.imatch(subject.subject, ".*#[a-z-]+$")
// not JUST numbers
and not regex.imatch(subject.subject, ".*#[0-9-]+$")
and not any(beta.ml_topic(body.current_thread.text).topics,
            .name in (
              "Professional and Career Development",
              "Reminders and Notifications"
            )
            and .confidence == "high"
)

// and 1 other suspicious element
and 2 of (
  any(recipients.to, strings.icontains(sender.display_name, .email.domain.sld)),
  (
    regex.imatch(sender.display_name, ".*#[a-z0-9-#]+$")
    and not regex.imatch(subject.subject, ".*#[a-z-]+$")
    and not regex.imatch(subject.subject, ".*#[0-9-]+$")
  ),
  any(ml.nlu_classifier(subject.subject).intents,
      .name == "cred_theft" and .confidence == "high"
  ),
  body.current_thread.text is null
)

// standard negations
and not profile.by_sender_email().any_messages_benign
and not profile.by_sender_email().solicited
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)