Skip to content

Commit bc56beb

Browse files
author
Sublime Rule Testing Bot
committed
Sync from PR#2658
Create spam_explicit_google_drive_share.yml by @aidenmitchell #2658 Source SHA a02e07c Triggered by @aidenmitchell
1 parent 5ce7743 commit bc56beb

3 files changed

+51
-0
lines changed

‎detection-rules/2658_spam_explicit_google_drive_share.yml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: "Spam: Sexually Explicit Google Drive Share"
2+
description: "Detects suspicious Google Drive Share which containing inappropriate content or suspicious patterns. The rule looks for reports from non-organizational domains that contain emojis or explicit keywords within the report."
3+
type: "rule"
4+
severity: "low"
5+
source: "type.inbound\n// \n// Warning: This rule contains sexually explicit keywords\n// \nand sender.email.email == \"[email protected]\"\n// the invite is not from an $org_domain user\nand all(headers.reply_to,\n .email.domain.domain not in $org_domains\n and .email.email not in $recipient_emails\n and .email.email not in $sender_emails\n)\n// the subject or the body contain sexually explicit keywords\nand any([subject.subject, body.current_thread.text],\n // this regex should be kept in sync between the Google Group and the Looker Studio rules\n regex.icontains(.,\n '(?:sex|horny|cock|fuck|\\bass\\b|pussy|dick|tits|cum|girlfriend|boyfriend|naked|porn|video|webcam|masturbate|orgasm|breasts|penis|vagina|strip|suck|blowjob|hardcore|xxx|nudes?|sexting|cheating|affair|erotic|lust|desire|intimate|explicit|fetish|kinky|seduce|adult\\s*(?:\\w+\\s+){0,2}\\s*community|cam shows|local (?:girls?|women|single)|hook.?up|bed partner)'\n )\n)\n"
6+
attack_types:
7+
- "Spam"
8+
tactics_and_techniques:
9+
- "Social engineering"
10+
- "Free email provider"
11+
detection_methods:
12+
- "Content analysis"
13+
- "Sender analysis"
14+
id: "6f38aff8-7c16-5ed4-d3ea-e036bf032e5b"
15+
og_id: "3f951c06-ea85-5e35-8b1c-57cc4fd8996e"
16+
testing_pr: 2658
17+
testing_sha: a02e07c3d808a74f4e130b7761230e9c77738f16

‎detection-rules/2658_spam_google_group_explict_invite.yml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: "Spam: Sexually Explicit Google Group Invitation"
2+
description: "Detects suspicious Google Groups invitations containing inappropriate content or suspicious patterns. The rule looks for invites from non-organizational domains that contain random alphanumeric strings, explicit keywords, or suspicious call-to-action phrases in the group names or descriptions."
3+
type: "rule"
4+
severity: "low"
5+
source: "type.inbound\n// \n// Warning: This rule contains sexually explicit keywords\n// \nand sender.email.email == \"[email protected]\"\nand (\n strings.istarts_with(subject.subject, 'Invitation to join ')\n or strings.istarts_with(subject.subject, 'You have been added to ')\n // the group name contains sexually explicit keywords\n // this regex should be kept in sync between the Google Group, Google Drive Share, and Looker Studio rules\n or regex.icontains(subject.subject,\n '(?:Invitation to join|You have been added to) .*(?:sex|horny|cock|fuck|\\bass\\b|pussy|dick|tits|cum|girlfriend|boyfriend|naked|porn|video|webcam|masturbate|orgasm|breasts|penis|vagina|strip|suck|blowjob|hardcore|xxx|nudes?|sexting|cheating|affair|erotic|lust|desire|intimate|explicit|fetish|kinky|seduce|adult community|cam shows|local (?:girls?|women|single)|hook.?up|bed partner)'\n )\n)\n// the invite is not from an $org_domain user\nand not any($org_domains,\n strings.icontains(body.current_thread.text,\n strings.concat('@',\n .,\n ' invited you to join the '\n )\n )\n or strings.icontains(body.current_thread.text,\n strings.concat('@', ., ' added you to the ')\n )\n)\nand (\n // the group name contains 7 char sets at the start and end and must contain a number\n regex.icontains(subject.subject,\n '(?:added to|to join) [A-Z0-9]{5,7} .*(?:[[:^ascii:]]|[[:^alpha:]]) [A-Z0-9]{5,7}$'\n )\n // calls to action in the group name\n or regex.icontains(subject.subject,\n '(?:added to|to join) .*(join|(?:click|go|tap) here)'\n )\n // it contains an emoji in the group name\n or regex.icontains(subject.subject,\n '(?:added to|to join) .*[\\x{1F300}-\\x{1F5FF}\\x{1F600}-\\x{1F64F}\\x{1F680}-\\x{1F6FF}\\x{1F700}-\\x{1F77F}\\x{1F780}-\\x{1F7FF}\\x{1F900}-\\x{1F9FF}\\x{2600}-\\x{26FF}\\x{2700}-\\x{27BF}\\x{2300}-\\x{23FF}]'\n )\n // the description of the group contains sexually explicit keywords\n // this regex should be kept in sync between the Google Group and the Looker Studio rules\n or regex.icontains(body.current_thread.text,\n '(?:about this group|message from).*(?:sex|horny|cock|fuck|\\bass\\b|pussy|dick|tits|cum|girlfriend|boyfriend|naked|porn|video|webcam|masturbate|orgasm|breasts|penis|vagina|strip|suck|blowjob|hardcore|xxx|nudes?|sexting|cheating|affair|erotic|lust|desire|intimate|explicit|fetish|kinky|seduce|adult community|cam shows|local (?:girls?|women|single)|hook.?up|bed partner).*https?://'\n )\n // the invitor is an email domain which contains 3 labels\n or (\n regex.icontains(body.current_thread.text,\n '\\n[^\\@]+@(?:[a-zA-Z0-9-]{1,255}\\.){2}[a-zA-Z0-9-]{2,255} (?:added you to the|invited you to join the)'\n )\n // where the group name contains \"lists.\"\n and not regex.icontains(body.current_thread.text,\n '\\n[^\\@]+@(?:[a-zA-Z0-9-]{1,255}\\.){2}[a-zA-Z0-9-]{2,255} (?:added you to the|invited you to join the) [^\\@]+\\@lists\\.'\n )\n )\n)\n"
6+
attack_types:
7+
- "Spam"
8+
tactics_and_techniques:
9+
- "Free email provider"
10+
- "Social engineering"
11+
detection_methods:
12+
- "Content analysis"
13+
- "Sender analysis"
14+
id: "7fbd71b3-1226-5018-6e59-7f9338e09e57"
15+
og_id: "4e0bec29-be9c-526f-ad56-824b4d87f55d"
16+
testing_pr: 2658
17+
testing_sha: a02e07c3d808a74f4e130b7761230e9c77738f16

‎detection-rules/2658_spam_google_looker_studio_report.yml

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
name: "Spam: Sexually Explicit Looker Studio Report"
2+
description: "Detects suspicious Looker Studio Reports which containing inappropriate content or suspicious patterns. The rule looks for reports from non-organizational domains that contain emojis or explicit keywords within the report."
3+
type: "rule"
4+
severity: "low"
5+
source: "type.inbound\n// \n// Warning: This rule contains sexually explicit keywords\n// \nand sender.email.email == \"[email protected]\"\n// the invite is not from an $org_domain user\nand all(headers.reply_to,\n .email.domain.domain not in $org_domains\n and .email.email not in $recipient_emails\n and .email.email not in $sender_emails\n)\n// the subject or the body contain sexually explicit keywords\nand any([subject.subject, body.current_thread.text],\n // this regex should be kept in sync between the Google Group, Google Drive Share, and Looker Studio rules\n regex.icontains(.,\n '(?:sex|horny|cock|fuck|\\bass\\b|pussy|dick|tits|cum|girlfriend|boyfriend|naked|porn|video|webcam|masturbate|orgasm|breasts|penis|vagina|strip|suck|blowjob|hardcore|xxx|nudes?|sexting|cheating|affair|erotic|lust|desire|intimate|explicit|fetish|kinky|seduce|adult\\s*(?:\\w+\\s+){0,2}\\s*community|cam shows|local (?:girls?|women|single)|hook.?up|bed partner)'\n )\n)\n"
6+
attack_types:
7+
- "Spam"
8+
tactics_and_techniques:
9+
- "Social engineering"
10+
- "Free email provider"
11+
detection_methods:
12+
- "Content analysis"
13+
- "Sender analysis"
14+
id: "45953c91-dbb1-5563-374b-41580a1d5723"
15+
og_id: "f1e649cd-63c0-5df4-86c9-72adc4eef0f0"
16+
testing_pr: 2658
17+
testing_sha: a02e07c3d808a74f4e130b7761230e9c77738f16

0 commit comments

Comments
 (0)