Medium Severity
Credential Phishing: Hyper-linked image leading to free file host
Description
This rule detects messages with short or null bodies, where all attachments are images, and the image is hyperlinking to a free_file_host from an unsolicited and untrusted sender.
References
No references.
Sublime Security
Created May 2nd, 2024 • Last updated May 2nd, 2024
Feed Source
Sublime Core Feed
Source
type.inbound
and length(body.links) > 0
and 0 < length(attachments) < 8
and all(attachments, .file_type in $file_types_images and .size > 2000)
and any(body.links,
// fingerprints of a hyperlinked image
.display_text is null
and .display_url.url is null
and .href_url.domain.root_domain in $free_file_hosts
)
and (
// body text is very short
(
0 <= (length(body.current_thread.text)) < 10
or body.current_thread.text is null
)
or (
length(body.current_thread.text) < 900
// or body is most likely all warning banner (text contains the sender and common warning banner language)
and (
(
strings.contains(body.current_thread.text, sender.email.email)
and strings.contains(body.current_thread.text, 'caution')
)
or regex.icontains(body.current_thread.text,
"intended recipient's use only|external email|sent from outside|you don't often|confidential"
)
)
)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and (
any(distinct(headers.hops, .authentication_results.dmarc is not null),
strings.ilike(.authentication_results.dmarc, "*fail")
)
)
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
// not solicited or previously flagged malicious/spam
and (
not profile.by_sender().solicited
or profile.by_sender().any_messages_malicious_or_spam
)
// negate legitimate canva emails
and not (
strings.contains(sender.display_name, "via Canva")
and sender.email.domain.domain == "canva.com"
and (
any(distinct(headers.hops, .authentication_results.dmarc is not null),
strings.ilike(.authentication_results.dmarc, "*pass")
)
)
)
Playground
Test against your own EMLs or sample data.