Medium Severity
Link: QR Code with suspicious language (untrusted sender)
Description
This rule analyzes image attachments for QR Codes that contain URLs including the recipient's email address. It ensures that the URLs do not link to any organizational domains. Additionally, it examines the email body using Natural Language Processing to detect credential phishing language.In cases of null bodies, the rule is conditioned to check the image for any suspicious terms.
References
No references.
Sublime Security
Created Aug 17th, 2023 • Last updated Apr 23rd, 2024
Feed Source
Sublime Core Feed
Source
type.inbound
// check image attachments for QR code, will want to add message.screenshot functionality here when it's ready
// and length(attachments) < 10
and any(attachments,
(.file_type in $file_types_images or .file_type == "pdf")
and any(file.explode(.),
.scan.qr.type == "url"
// recipient email address is present in the URL, a common tactic used in credential phishing attacks and the url is not in $org_domains
and any(recipients.to,
strings.icontains(..scan.qr.data, .email.email) and .email.domain.valid
)
and .scan.qr.url.domain.root_domain not in $org_domains
)
)
// NLU has identified cred_theft language with high confidence
and (
any(ml.nlu_classifier(body.current_thread.text).intents,
.name == "cred_theft" and .confidence == "high"
)
or
// the attachment contains suspicious strings
(
any(attachments,
(.file_type in $file_types_images or .file_type == "pdf")
and any(file.explode(.),
any(.scan.strings.strings,
regex.icontains(.,
'(\b2fa\b|\bQ.?R\.?\s?\b|MFA|Muti[ -]?Factor Auth(entication)?)'
)
)
)
)
)
)
and (
profile.by_sender().prevalence in ("new", "outlier")
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_false_positives
)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Playground
Test against your own EMLs or sample data.