Skip to content

Commit 6bf3b01

Browse files
author
Sublime Rule Testing Bot
committed
Sync from PR#2692
Update attachment_fake_attachment_image.yml by @aidenmitchell #2692 Source SHA e3df478 Triggered by @aidenmitchell
1 parent f7fab41 commit 6bf3b01

File tree

1 file changed

+2
-81
lines changed

1 file changed

+2
-81
lines changed

‎detection-rules/2692_attachment_fake_attachment_image.yml‎

Lines changed: 2 additions & 81 deletions
Original file line numberDiff line numberDiff line change
@@ -3,86 +3,7 @@ description: |
33
Message (or attached message) contains an image impersonating an Outlook attachment button.
44
type: "rule"
55
severity: "medium"
6-
source: |
7-
type.inbound
8-
and length(attachments) < 8
9-
and (
10-
// fake file attachment preview in original email
11-
any(attachments,
12-
.file_type in $file_types_images
13-
and (
14-
any(ml.logo_detect(.).brands, .name == "FakeAttachment")
15-
or (
16-
.size < 30000
17-
and any(file.explode(.),
18-
strings.icontains(.scan.ocr.raw, 'sent you')
19-
// the attached image includes a filesize string
20-
and regex.icontains(.scan.ocr.raw,
21-
'\b\d+.\d{1,2}\s?(k|m)b(\s|$)'
22-
)
23-
)
24-
)
25-
)
26-
)
27-
// message body/screenhot
28-
or (
29-
any(ml.logo_detect(beta.message_screenshot()).brands,
30-
.name == "FakeAttachment"
31-
)
32-
or (
33-
length(body.current_thread.text) < 2000
34-
and strings.icontains(body.current_thread.text, 'sent you')
35-
// the attached image includes a filesize string
36-
and regex.icontains(body.current_thread.text,
37-
'\b\d+.\d{1,2}\s?(k|m)b(\s|$)'
38-
)
39-
)
40-
)
41-
// fake file attachment preview in attached EML
42-
or any(attachments,
43-
(.content_type == "message/rfc822" or .file_extension == "eml")
44-
and any(file.parse_eml(.).attachments,
45-
.file_type in $file_types_images
46-
and (
47-
any(ml.logo_detect(.).brands, .name == "FakeAttachment")
48-
or (
49-
.size < 30000
50-
and any(file.explode(.),
51-
strings.icontains(.scan.ocr.raw, 'sent you')
52-
// the attached image includes a filesize string
53-
and regex.icontains(.scan.ocr.raw,
54-
'\b\d+.\d{1,2}\s?(k|m)b(\s|$)'
55-
)
56-
)
57-
)
58-
)
59-
)
60-
)
61-
)
62-
and not (
63-
(
64-
strings.istarts_with(subject.subject, "RE:")
65-
or strings.istarts_with(subject.subject, "R:")
66-
or strings.istarts_with(subject.subject, "ODG:")
67-
or strings.istarts_with(subject.subject, "答复:")
68-
or strings.istarts_with(subject.subject, "AW:")
69-
or strings.istarts_with(subject.subject, "TR:")
70-
or strings.istarts_with(subject.subject, "FWD:")
71-
or regex.imatch(subject.subject, '(\[[^\]]+\]\s?){0,3}(re|fwd?)\s?:')
72-
)
73-
and (
74-
length(headers.references) > 0
75-
or any(headers.hops, any(.fields, strings.ilike(.name, "In-Reply-To")))
76-
)
77-
)
78-
// negate highly trusted sender domains unless they fail DMARC authentication
79-
and (
80-
(
81-
sender.email.domain.root_domain in $high_trust_sender_root_domains
82-
and not headers.auth_summary.dmarc.pass
83-
)
84-
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
85-
)
6+
source: "type.inbound\nand length(attachments) < 8\nand (\n // fake file attachment preview in original email\n any(attachments,\n .file_type in $file_types_images\n and (\n any(ml.logo_detect(.).brands, .name == \"FakeAttachment\")\n or (\n .size < 30000\n and any(file.explode(.),\n strings.icontains(.scan.ocr.raw, 'sent you')\n // the attached image includes a filesize string\n and regex.icontains(.scan.ocr.raw,\n '\\b\\d+.\\d{1,2}\\s?(k|m)b(\\s|$)'\n )\n )\n )\n )\n )\n // message body/screenhot\n or (\n any(ml.logo_detect(beta.message_screenshot()).brands,\n .name == \"FakeAttachment\"\n )\n or (\n length(body.current_thread.text) < 2000\n and strings.icontains(body.current_thread.text, 'sent you')\n // the attached image includes a filesize string\n and regex.icontains(body.current_thread.text,\n '\\b\\d+.\\d{1,2}\\s?(k|m)b(\\s|$)'\n )\n )\n )\n // Suspicious table with file size indicators \n or regex.contains(body.html.raw,\n \"<table[^>]*>.*?<img[^>]+src=[\\\"']cid:[^\\\"']+[\\\"'][^>]*>.*?\\\\.(pdf|doc(x)|xls(x)?).*?<font[^>]*>\\\\s*\\\\d{1,4}\\\\.\\\\d{1,2}\\\\s*k[bB]\"\n )\n\n // fake file attachment preview in attached EML\n or any(attachments,\n (.content_type == \"message/rfc822\" or .file_extension == \"eml\")\n and any(file.parse_eml(.).attachments,\n .file_type in $file_types_images\n and (\n any(ml.logo_detect(.).brands, .name == \"FakeAttachment\")\n or (\n .size < 30000\n and any(file.explode(.),\n strings.icontains(.scan.ocr.raw, 'sent you')\n // the attached image includes a filesize string\n and regex.icontains(.scan.ocr.raw,\n '\\b\\d+.\\d{1,2}\\s?(k|m)b(\\s|$)'\n )\n )\n )\n )\n )\n )\n)\nand not (\n (\n strings.istarts_with(subject.subject, \"RE:\")\n or strings.istarts_with(subject.subject, \"R:\")\n or strings.istarts_with(subject.subject, \"ODG:\")\n or strings.istarts_with(subject.subject, \"答复:\")\n or strings.istarts_with(subject.subject, \"AW:\")\n or strings.istarts_with(subject.subject, \"TR:\")\n or strings.istarts_with(subject.subject, \"FWD:\")\n or regex.imatch(subject.subject, '(\\[[^\\]]+\\]\\s?){0,3}(re|fwd?)\\s?:')\n or regex.imatch(subject.subject,\n '^\\[?(EXT|EXTERNAL)\\]?[: ]\\s*(RE|FWD?|FW|AW|TR|ODG|答复):.*'\n )\n )\n and (\n length(headers.references) > 0\n or any(headers.hops, any(.fields, strings.ilike(.name, \"In-Reply-To\")))\n )\n)\n// negate highly trusted sender domains unless they fail DMARC authentication\nand (\n (\n sender.email.domain.root_domain in $high_trust_sender_root_domains\n and not headers.auth_summary.dmarc.pass\n )\n or sender.email.domain.root_domain not in $high_trust_sender_root_domains\n)\n"
867
tags:
878
- "Suspicious attachment"
889
- "Suspicious content"
@@ -100,4 +21,4 @@ detection_methods:
10021
id: "c6d34a72-ee3b-526f-f627-68257644772e"
10122
og_id: "96b8b285-2116-5e45-b0ca-57b81dc87b94"
10223
testing_pr: 2692
103-
testing_sha: b205f1727d4c38474e15522a789a3e593a8618e3
24+
testing_sha: e3df478e528581f17bf81f4e677d320a992c278d

0 commit comments

Comments
 (0)