sublime-rules/detection-rules/spam_web_errors_solicitation.yml at 0c8ccb8588edb81944e5fc98628ee5de54a1e36a · sublime-security/sublime-rules · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: "Spam: Website errors solicitation"
description: "This rule detects messages claiming to have identified errors on a website. The messages typically offer to send pricing or information upon request."
type: "rule"
severity: "low"
source: |
  type.inbound
  and not profile.by_sender().solicited
  // no attachments
  and length(attachments) == 0
  // subject must contain SEO or web dev spam keywords or be short
  and (
    (
      // SEO or web development service keywords
      regex.icontains(strings.replace_confusables(subject.subject),
                      '(?:proposal|cost|estimate|error|bug|audit|screenshot|strategy|rankings|issues|fix|website|design|review|price)'
      )
      or regex.icontains(subject.base,
                         '[^\x{2600}-\x{27BF}\x{1F300}-\x{1F9FF}][\x{2600}-\x{27BF}\x{1F300}-\x{1F9FF}]\x{FE0F}?$'
      )
      // report and follow up keywords
      or (
        strings.icontains(strings.replace_confusables(subject.subject), "report")
        and regex.icontains(strings.replace_confusables(body.current_thread.text),
                            "(?:free|send you|can i send|may i send|let me know|interested|get back to me|reply back|just reply)"
        )
      )
      // short subject
      or length(subject.base) < 5
    )
    // or a reply or forward in a thread that mentions website or screenshots
    or (
      (length(subject.base) < 5 or subject.is_reply or subject.is_forward)
      and any(body.previous_threads,
              regex.icontains(strings.replace_confusables(.text),
                              "(?:screenshot|website)"
              )
      )
    )
  )
  // body structure and content patterns
  and (
    // Single thread with no links
    (
      length(body.links) == 0
      and length(body.previous_threads) == 0
      // short message between 20 and 500 chars
      and 20 < length(body.current_thread.text) < 500
      // service offering keywords
      and regex.icontains(strings.replace_confusables(body.current_thread.text),
                          "(?:available|screenshot|error list|plan|quote|rank|professional|price|mistake|visibility|improvement|review|emailed.{0,10}more details)"
      )
      // generic greeting
      and regex.icontains(strings.replace_confusables(body.current_thread.text),
                          'h(?:i|ello|ey)\b'
      )
      // problem or urgency keywords
      and regex.icontains(strings.replace_confusables(body.current_thread.text),
                          '(?:error|report|issues|website|repair|redesign|upgrade|Google\s+.{0,15}find it|glitch)'
      )
      // website or page mention
      and regex.icontains(strings.replace_confusables(body.current_thread.text),
                          "(?:site|website|page)"
      )
      and regex.icontains(strings.replace_confusables(body.current_thread.text),
                          '(mail\.|mx|\.u)?\.?@?(aol|yahoo|hotmail|google|gmail|googlemail)\.com'
      )
    )
    or any(body.links, regex.icontains(.display_text, '\.?@?(hotmail)\.com'))
    // Single thread with unsubscribe link or $org_domains link
    or (
      length(body.links) <= 3
      and (
        // unsubscribe mailto link
        regex.icontains(body.html.raw, "mailto:*[++unsubscribe@]")
        // or link to found in org_domains
        or any(body.links, .href_url.domain.root_domain in~ $org_domains)
      )
      and length(body.previous_threads) == 0
      // short message between 20 and 500 chars
      and 20 < length(body.current_thread.text) < 500
      // service offering keywords
      and regex.icontains(strings.replace_confusables(body.current_thread.text),
                          "(?:screenshot|error list|plan|quote|rank|professional|price|mistake)"
      )
      // generic greeting
      and regex.icontains(strings.replace_confusables(body.current_thread.text),
                          '(?:h(?:i|ello|ey)|morning)\b'
      )
      // problem or urgency keywords
      and regex.icontains(strings.replace_confusables(body.current_thread.text),
                          '(?:error|report|issues|website|repair|redesign|upgrade|Google\s+.{0,15}find it)'
      )
      // website or page mention
      and regex.icontains(strings.replace_confusables(body.current_thread.text),
                          "(?:site|website|page)"
      )
    )
    // Multiple thread messages
    or (
      length(body.links) == 0
      // small thread with less than 5 messages
      and length(body.previous_threads) < 5
      // check previous messages for spam characteristics
      and any(body.previous_threads,
              // short previous messages less than 400 chars
              length(.text) < 400
              and (
                // generic greeting
                regex.icontains(strings.replace_confusables(.text),
                                '(?:h(?:i|ello|ey)|morning)\b'
                )
                // service offering keywords
                and regex.icontains(strings.replace_confusables(.text),
                                    '(?:\berror(?:\s+list)?\b|screenshot|report|plan)'
                )
                // previous threads written in English
                and ml.nlu_classifier(.text).language == "english"
              )
      )
    )
  )
tags:
  - "Attack surface reduction"
attack_types:
  - "Spam"
detection_methods:
  - "Content analysis"
  - "Sender analysis"
  - "Natural Language Understanding"
id: "122ea794-f619-5f29-acb2-83261d8f81fc"