Sublime MQL rules: vip

type.inbound
and (
  // the display name matches a name on the orgs vip list
  any($org_vips, .display_name =~ sender.display_name)
  // or the display name starts with the name on the orgs vip list
  or (
    any($org_vips,
        strings.istarts_with(sender.display_name, .display_name)
        // and it is longer than just their name (eg. John Doe CEO)
        and length(sender.display_name) > length(.display_name)
    )
    // and we have confidence it's BEC
    and any(ml.nlu_classifier(body.current_thread.text).intents,
            .name == "bec" and .confidence == "high"
    )
  )
)
and (
  // ignore personal <> work emails
  // where the sender and mailbox's display name are the same
  length(recipients.to) > 0
  or length(recipients.cc) > 0
  or sender.display_name != mailbox.display_name
)
// bounce-back negations
and not strings.like(sender.email.local_part,
                     "*postmaster*",
                     "*mailer-daemon*",
                     "*administrator*"
)
and not any(attachments,
            .content_type in (
              "message/rfc822",
              "message/delivery-status",
              "text/calendar"
            )
)
and (
  (
    profile.by_sender_email().prevalence in ("new", "outlier")
    and not profile.by_sender_email().solicited
  )
  or (
    profile.by_sender_email().any_messages_malicious_or_spam
    and not profile.by_sender_email().any_messages_benign
  )
  // mismatched reply-to with unsoliticed reply-to address
  or (
    length(headers.reply_to) > 0
    and (sender.email.email not in map(headers.reply_to, .email.email))
    // negate reply-to addresses that are within the org domain
    and not all(headers.reply_to,
                .email.domain.domain in $org_domains
                or .email.domain.root_domain in $org_domains
    )
    //
    // This rule makes use of a beta feature and is subject to change without notice
    // using the beta feature in custom rules is not suggested until it has been formally released
    //
    and not beta.profile.by_reply_to().solicited
    and beta.profile.by_reply_to().prevalence != "common"
  )
)
and (
  (
    sender.email.domain.root_domain in $org_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $org_domains
)
and not profile.by_sender_email().any_messages_benign

type.inbound
and any($org_vips,
        strings.contains(subject.subject, .display_name)
        and strings.contains(.display_name, " ")
)
// not being sent to said VIP
and not (
  (
    length(recipients.to) == 1
    and all(recipients.to,
            any($org_vips,
                .email == ..email.email
                and strings.contains(subject.subject, .display_name)
                and strings.contains(.display_name, " ")
            )
    )
  )
)
and (
  // ignore personal <> work emails
  // where the sender and mailbox's display name are the same
  length(recipients.to) > 0
  or length(recipients.cc) > 0
  or sender.display_name != mailbox.display_name
)
// bounce-back negations
and not strings.like(sender.email.local_part,
                     "*postmaster*",
                     "*mailer-daemon*",
                     "*administrator*"
)
and not any(attachments,
            .content_type in (
              "message/rfc822",
              "message/delivery-status",
              "text/calendar"
            )
)
and (
  (
    profile.by_sender().prevalence in ("new", "outlier")
    and not profile.by_sender().solicited
  )
  or (
    profile.by_sender().any_messages_malicious_or_spam
    and not profile.by_sender().any_messages_benign
  )
)

// negate org domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $org_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $org_domains
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

type.inbound
and strings.ilike(body.current_thread.text,
                  "*charity*",
                  "*gala*",
                  "*donation*",
                  "*donor*"
)
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "financial"
)
and any(ml.nlu_classifier(body.current_thread.text).entities,
        .name == "request"
)
and (
  any($org_vips, strings.icontains(body.html.inner_text, .display_name))
  or any($org_vips, strings.icontains(body.plain.raw, .display_name))
)
and (
  (
    (subject.is_forward or subject.is_reply)
    and (
      (length(headers.references) == 0 and headers.in_reply_to is null)
      or headers.in_reply_to is null
    )
  )
  // fake thread, but no indication in the subject line
  // current_thread pulls the recent thread, but the full body contains the fake "original" email
  or (
    not ((subject.is_forward or subject.is_reply))
    and (
      3 of (
        strings.icontains(body.html.display_text, "from:"),
        strings.icontains(body.html.display_text, "to:"),
        strings.icontains(body.html.display_text, "sent:"),
        strings.icontains(body.html.display_text, "subject:")
      )
      or length(body.previous_threads) > 0
    )
    and (
      length(body.current_thread.text) + 100 < length(body.html.display_text)
    )
    // negating bouncebacks
    and not any(attachments,
                .content_type in ("message/delivery-status", "message/rfc822")
    )
  )
)
and (
  profile.by_sender().prevalence in ("new", "rare")
  or profile.by_sender().days_known > 30
)
and not profile.by_sender().any_messages_benign

type.inbound
and any(filter(body.previous_threads,
               // single recipient in the previous thread
               length(.recipients.to) == 1
               and length(.recipients.cc) == 0
               // contains spaces around the colons of the "headers"
               and strings.count(.preamble, ' : ') >= 2
               and regex.icount(.preamble, '(?m)^\s*[a-z]+ +: +\S') == regex.icount(.preamble,
                                                                                    '(?m)^.'
               )
        ),
        // the previous thread with the goofy spaces
        // includes a VIP as a recipient
        any(map(filter(.recipients.to,
                       // via email
                       .email.email != ""
                       and any($org_vips,
                               strings.icontains(..email.email, .email)
                               or strings.icontains(..display_name,
                                                    .display_name
                               )
                       )
                ),
                .email.email
            ),
            // email is not in the "live" messages
            not strings.icontains(sender.email.email, .)
            and not any(recipients.to, strings.icontains(.email.email, ..))
            and not any(recipients.cc, strings.icontains(.email.email, ..))
        )
        or any(map(filter(.recipients.to,
                          // via display_name
                          .email.email == ""
                          and any($org_vips,
                                  strings.icontains(..display_name,
                                                    .display_name
                                  )
                          )
                   ),
                   .display_name
               ),
               // display name is not in the "live" messages
               not any(recipients.to, .display_name == ..)
               and not any(recipients.cc, .display_name == ..)
               and sender.display_name != .
        )
)

type.inbound
and length(coalesce(body.plain.raw, body.html.display_text)) < 6000
and (
  // the current thread contains a goofy forwarded message
  (
    strings.icontains(body.current_thread.text, 'forwarded')
    // not this specific format
    and not strings.icontains(body.current_thread.text,
                              '============ Forwarded Message ============'
    )
    and regex.icontains(body.current_thread.text,
                        '(?m)^[=\x{2012}\x{2013}\x{2014}\x{2015}\s]*message that has been forwarded',
                        '={3,}\s*(?:forwarded message|message that has been forwarded)',
                        '[\x{2013}]{2,}\s*(?:forwarded message|message that has been forwarded)'
    )
  )
  // any previous thread contains a goofy forwarded message
  or any(body.previous_threads,
         strings.icontains(.text, 'forwarded')
         // not this specific format
         and not strings.icontains(.text,
                                   '============ Forwarded Message ============'
         )
         and regex.icontains(.text,
                             '(?m)^[=\x{2012}\x{2013}\x{2014}\x{2015}\s]*message that has been forwarded',
                             '={3,}\s*(?:forwarded message|message that has been forwarded)',
                             '[\x{2013}]{2,}\s*(?:forwarded message|message that has been forwarded)'
         )
  )
)
// any of the previous threads were sent to a VIP
and any(body.previous_threads,
        any(.recipients.to,
            any($org_vips,
                strings.icontains(..display_name, .display_name)
                or (.email != "" and strings.icontains(..email.email, .email))
            )
        )
)

type.inbound
and any($org_vips,
        strings.icontains(body.html.display_text,
                          strings.concat("From: ", .display_name, " <")
        )
        and not strings.icontains(body.html.display_text,
                                  strings.concat("From: ",
                                                 .display_name,
                                                 " <",
                                                 .email,
                                                 ">"
                                  )
        )
)
and any([body.current_thread.text, body.html.display_text, body.plain.raw],
        3 of (
          strings.icontains(., "from:"),
          strings.icontains(., "to:"),
          strings.icontains(., "sent:"),
          strings.icontains(., "date:"),
          strings.icontains(., "cc:"),
          strings.icontains(., "subject:")
        )
)
and (length(headers.references) == 0 or headers.in_reply_to is null)

type.inbound
// we need at least two threads
and length(body.previous_threads) > 1
and (
  // NLU on previous threads
  ( // oldest thread is invoice/payment related
    (
      any(ml.nlu_classifier(body.previous_threads[length(body.previous_threads) - 1].text,
                            subject=body.previous_threads[length(body.previous_threads
                            ) - 1].subject.base
          ).tags,
          .name in ("invoice", "payment") and .confidence != "low"
      )
      or any(ml.nlu_classifier(body.previous_threads[length(body.previous_threads
                               ) - 1].text,
                               subject=body.previous_threads[length(body.previous_threads
                               ) - 1].subject.base
             ).topics,
             .name in ("Request to View Invoice", "Payment Information")
             and .confidence != "low"
      )
    )
    // second to oldest thread is invoice/payment related
    and (
      any(ml.nlu_classifier(body.previous_threads[length(body.previous_threads) - 2].text,
                            subject=body.previous_threads[length(body.previous_threads
                            ) - 2].subject.base
          ).tags,
          .name in ("invoice", "payment") and .confidence != "low"
      )
      or any(ml.nlu_classifier(body.previous_threads[length(body.previous_threads
                               ) - 2].text,
                               subject=body.previous_threads[length(body.previous_threads
                               ) - 2].subject.base
             ).topics,
             .name in ("Request to View Invoice", "Payment Information")
             and .confidence != "low"
      )
    )
  )
  // if we don't get NLU but there is a W9 or Inv attached, we can assume it's invoice related
  or any(attachments, strings.istarts_with(.file_name, 'INV', "W-9", 'W9'))
)
// each of the two oldest threads have 1 or less recipients (sometimes the "to" header is missing)
and length(body.previous_threads[length(body.previous_threads) - 1].recipients.to
) <= 1
and length(body.previous_threads[length(body.previous_threads) - 2].recipients.to
) <= 1
// at least one party in the two oldest threads is missing an email
and (
  body.previous_threads[length(body.previous_threads) - 1].sender.email.email == ""
  or body.previous_threads[length(body.previous_threads) - 1].recipients.to[0].email.email == ""
  or body.previous_threads[length(body.previous_threads) - 2].sender.email.email == ""
  or body.previous_threads[length(body.previous_threads) - 2].recipients.to[0].email.email == ""
)
// an org vip sent/received messages
and any($org_vips,
        (
          body.previous_threads[length(body.previous_threads) - 1].recipients.to[0].display_name == .display_name
          and body.previous_threads[length(body.previous_threads) - 2].sender.display_name == .display_name
        )
        or (
          body.previous_threads[length(body.previous_threads) - 1].sender.display_name == .display_name
          and body.previous_threads[length(body.previous_threads) - 2].recipients.to[0].display_name == .display_name
        )
)
// the VIP is no longer in the current message
and not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
            any($org_vips,
                .email != ""
                and strings.icontains(..email.email, .email)
                and (
                  (
                    body.previous_threads[length(body.previous_threads) - 1].recipients.to[0].display_name == .display_name
                    and body.previous_threads[length(body.previous_threads) - 2].sender.display_name == .display_name
                  )
                  or (
                    body.previous_threads[length(body.previous_threads) - 1].sender.display_name == .display_name
                    and body.previous_threads[length(body.previous_threads) - 2].recipients.to[0].display_name == .display_name
                  )
                )
            )
)
// not from authorized senders on the org's domain
and not (
  sender.email.domain.domain in $org_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

type.inbound
and any(map(filter(body.previous_threads,
                   any($org_vips,
                       strings.icontains(..sender.display_name, .display_name)
                       or (
                         .email != ""
                         and strings.icontains(..sender.email.email, .email)
                       )
                   )
                   and (
                     strings.iends_with(.text, "sent from my iphone.")
                     or strings.iends_with(.text, "sent from my ipad.")
                   )
                   and (
                     // any previous thread authored by the "VIP" has invoice/payment
                     any(ml.nlu_classifier(.text, subject=.subject.base).tags,
                         .name in ("invoice", "payment")
                         and .confidence != "low"
                     )
                     or any(ml.nlu_classifier(.text, subject=.subject.base).topics,
                            .name in (
                              "Request to View Invoice",
                              "Payment Information"
                            )
                            and .confidence != "low"
                     )

                     // if we don't get NLU but there is a W9 or Inv attached, we can assume it's invoice related
                     or any(attachments,
                            strings.istarts_with(.file_name, 'INV', "W-9", 'W9')
                     )
                   )
            ),
            .sender.email.email
        ),
        . == ""
        or (
          not strings.icontains(sender.email.email, .)
          and not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
                      strings.icontains(.email.email, ..)
          )
        )
)

// note to rule writers
// this rule has a related rule which covers the same logic, but handles the "email address" but no display name in preivous threads
// very likely the logic will need updated in the corresponding rule
// see vip_impersonation_fake_thread_with_invoice_handoff_email.yml
type.inbound
and any(map(filter(body.previous_threads,
                   .sender.email.email == ""
                   and .sender.display_name != ""
                   and any($org_vips,
                           strings.icontains(..sender.display_name,
                                             .display_name
                           )
                   )
                   and not coalesce(.subject.is_auto_reply, false)
                   and any(recipients.to,
                           .email.domain.root_domain in $org_domains
                           and strings.icontains(..text, .email.email)
                   )
                   // payment "handoff" phrasing.
                   and regex.icontains(.text,
                                       'accounts? payable',
                                       '(?:forward|send|rout|direct|remit|submit|issue) (?:it|a copy) (?:directly )?to',
                                       '(?:forward|send|direct|remit|submit|route) (?:the |all |related |for )?(?:invoice|correspondence|payment|billing|processing)',
                                       'for payment processing,? please contact',
                                       '(?:please )?direct (?:it|all|the)[^\n]{0,60}\bto\b',
                                       '(?:as follows|provided below|find below|details are|contact is)[^\n]{0,10}:',
                                       'billing (?:contact|correspondence|team|department)',
                                       'a copy.{0,20}sent to',
                   )
            ),
            .sender.display_name
        ),
        . != ""
        // any previous thread authored by the "VIP" has invoice/payment
        and (
          any(filter(body.previous_threads, .sender.email.email == ..),
              any(ml.nlu_classifier(.text, subject=.subject.base).tags,
                  .name in ("invoice", "payment") and .confidence != "low"
              )
              or any(ml.nlu_classifier(.text, subject=.subject.base).topics,
                     .name in ("Request to View Invoice", "Payment Information")
                     and .confidence != "low"
              )
          )
          // if we don't get NLU but there is a W9 or Inv attached, we can assume it's invoice related
          or any(attachments,
                 strings.istarts_with(.file_name, 'INV', "W-9", 'W9')
          )
        )
        and not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
                    any($org_vips,
                        strings.icontains(..., .display_name)
                        and .email != ""
                        and strings.icontains(..email.email, .email)
                    )
        )
)
and length(filter(flatten([recipients.to, recipients.cc, recipients.bcc]),
                  .email.domain.root_domain in $org_domains
           )
) == 1
and not (
  sender.email.domain.root_domain in $org_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

type.inbound
and length(body.previous_threads) > 1

// the oldest segment is a forward and has a single recipient which is the VIP
and length(body.previous_threads[length(body.previous_threads) - 1].recipients.to
) == 1
// the segment is a forward
// handle where there is no subject
and coalesce(body.previous_threads[length(body.previous_threads) - 1].subject.is_forward,
             false
)
and any($org_vips,
        // oldest thread (len-1) forward is TO the VIP
        body.previous_threads[length(body.previous_threads) - 1].recipients.to[0].display_name =~ .display_name
        // next oldest thread (len-2) is FROM the same VIP;
        and body.previous_threads[length(body.previous_threads) - 2].sender.display_name =~ .display_name
)
// the rcpt email format of the oldest thread matches the sender email format of the next oldest thread
and body.previous_threads[length(body.previous_threads) - 1].recipients.to[0].email.email =~ body.previous_threads[length(body.previous_threads
) - 2].sender.email.email

// the message authored by the "VIP" links to an email (parsed mailto:) that the live message now routes to
// this is the "VIP handoff" step, the fake VIP mentions the email address, which becomes the "victim", the actor sends it to that address and includes the faked emails emails in the chain.
and any(body.previous_threads[length(body.previous_threads) - 2].links,
        .href_url.url != ""
        and .href_url.scheme == "mailto"
        and any(flatten([recipients.to, recipients.cc, recipients.bcc]),
                strings.icontains(.email.email, ..href_url.url)
        )
)

// the VIP's authoritative list-email is NOT among the live recipients (dropped)
and not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
            any($org_vips,
                .email != ""
                and strings.icontains(..email.email, .email)
                and body.previous_threads[length(body.previous_threads) - 2].sender.display_name =~ .display_name
            )
)
// we only have a single org_domain recipient
and length(filter(flatten([recipients.to, recipients.cc, recipients.bcc]),
                  .email.domain.root_domain in $org_domains
           )
) == 1
// this message is not from the org itself
and not (
  sender.email.domain.root_domain in $org_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

type.inbound
and length(coalesce(body.plain.raw, body.html.display_text)) < 6000
and strings.icontains(strings.replace_confusables(subject.base),
                      '"',
                      '/-/',
                      '-//',
                      '-/',
                      '-#'
)
and any(body.previous_threads,
        any($org_vips,
            (
              strings.icontains(strings.replace_confusables(subject.base),
                                strings.concat('"', .display_name)
              )
              or strings.icontains(strings.replace_confusables(subject.base),
                                   strings.concat(.display_name, '"')
              )
              or strings.icontains(strings.replace_confusables(subject.base),
                                   strings.concat('/-/', .display_name)
              )
              or strings.icontains(strings.replace_confusables(subject.base),
                                   strings.concat('-//', .display_name)
              )
              or strings.icontains(strings.replace_confusables(subject.base),
                                   strings.concat('-/', .display_name)
              )
              or strings.icontains(strings.replace_confusables(subject.base),
                                   strings.concat('-#', .display_name)
              )
            )
            and (
              strings.icontains(..sender.display_name, .display_name)
              or (
                .email != "" and strings.icontains(..sender.email.email, .email)
              )
              or (
                strings.icontains(sender.display_name, .display_name)
                and sender.email.email != .email
              )
            )
        )
)
and any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in (
          "Financial Communications",
          "Request to View Invoice",
          "Payment Information"
        )
        and .confidence != "low"
)

// note to rule writers
// this rule has a related rule which covers the same logic, but handles the display name but no email address in preivous threads
// very likely the logic will need updated in the corresponding rule
// see vip_impersonation_fake_thread_with_invoice_handoff_display_name.yml
type.inbound
and any(map(filter(body.previous_threads,
                   // VIP authored the segment: display_name OR real email (OR, not AND -- the actor guesses
                   // the exec's address, so a fabricated From: is often the wrong format at the right org).
                   any($org_vips,
                       strings.icontains(..sender.display_name, .display_name)
                       or (
                         .email != ""
                         and strings.icontains(..sender.email.email, .email)
                       )
                   )
                   // skip auto-replies; coalesce the null on subject-less segments before `not`.
                   and not coalesce(.subject.is_auto_reply, false)
                   // the live recipient is the payee the VIP names, at an org domain.
                   and any(recipients.to,
                           .email.email != ..sender.email.email
                           and .email.domain.root_domain in $org_domains
                           and strings.icontains(..text, .email.email)
                   )
                   // payment "handoff" phrasing.
                   and regex.icontains(.text,
                                       'accounts? payable',
                                       '(?:forward|send|rout|direct|remit|submit|issue) (?:it|a copy) (?:directly )?to',
                                       '(?:forward|send|direct|remit|submit|route) (?:the |all |related |for )?(?:invoice|correspondence|payment|billing|processing)',
                                       'for payment processing,? please contact',
                                       '(?:please )?direct (?:it|all|the)[^\n]{0,60}\bto\b',
                                       '(?:as follows|provided below|find below|details are|contact is)[^\n]{0,10}:',
                                       'billing (?:contact|correspondence|team|department)',
                                       'a copy.{0,20}sent to',
                   )
            ),
            .sender.email.email
        ),
        . != ""
        // the VIP is no longer present in the live message.
        and not strings.icontains(sender.email.email, .)
        and not any(flatten([recipients.to, recipients.cc, recipients.bcc]),
                    strings.icontains(.email.email, ..)
        )
        // any previous thread authored by the "VIP" has invoice/payment
        and (
          any(filter(body.previous_threads, .sender.email.email == ..),
              any(ml.nlu_classifier(.text, subject=.subject.base).tags,
                  .name in ("invoice", "payment") and .confidence != "low"
              )
              or any(ml.nlu_classifier(.text, subject=.subject.base).topics,
                     .name in ("Request to View Invoice", "Payment Information")
                     and .confidence != "low"
              )
          )
          // if we don't get NLU but there is a W9 or Inv attached, we can assume it's invoice related
          or any(attachments,
                 strings.istarts_with(.file_name, 'INV', "W-9", 'W9')
          )
        )
)
// exactly one org-domain recipient (the payee); external sender.
and length(filter(flatten([recipients.to, recipients.cc, recipients.bcc]),
                  .email.domain.root_domain in $org_domains
           )
) == 1
and not sender.email.domain.root_domain in $org_domains

type.inbound
and any(body.previous_threads,
        any(.recipients.to,
            any($org_vips,
                strings.icontains(..display_name, .display_name)
                or strings.icontains(..email.email, .email)
            )
        )
)
and (
  strings.icontains(body.html.raw, 'Advanced HTML parser')
  or regex.icontains(body.html.raw, '<title>\s*HTML Message\s*</title>')
)

type.inbound
and strings.contains(sender.email.local_part, ".")
and any($org_vips,
        strings.starts_with(.email, sender.email.local_part)
        and (
          sender.email.email != .email
          or (
            sender.email.email == .email and not headers.auth_summary.dmarc.pass
          )
        )
)
and (
  // ignore personal <> work emails
  // where the sender and mailbox's display name are the same
  length(recipients.to) > 0
  or length(recipients.cc) > 0
  or sender.display_name != mailbox.display_name
)
// bounce-back negations
and not strings.like(sender.email.local_part,
                     "*postmaster*",
                     "*mailer-daemon*",
                     "*administrator*"
)

// negate org domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $org_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $org_domains
)

// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and not headers.auth_summary.dmarc.pass
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
// sender profile
and (
  not profile.by_sender_email().solicited
  or not profile.by_sender_email().any_messages_benign
  or (
    profile.by_sender_email().any_messages_malicious_or_spam
    and not profile.by_sender_email().any_messages_benign
  )
  or (
    sender.email.domain.domain in $org_domains
    and not coalesce(headers.auth_summary.dmarc.pass, false)
  )
)