[Test Rules] [PR #4566] added rule: Reconnaissance: Short generic greeting message

Author: github-actions[bot]

detection-rules/4566_recon_short_generic_greeting.yml

@@ -0,0 +1,88 @@
+name: "Reconnaissance: Short generic greeting message"
+description: |
+  Detects potential reconnaissance messages with very short, generic content like 'Hi' or 'Hello' from external senders. These messages are often used to validate email addresses and test deliverability before launching larger attacks.
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  // detect generic greetings
+  and length(body.current_thread.text) <= 20
+  and length(subject.base) <= 15
+  // exclude messages with previous thread context (forwards/replies)
+  and length(body.previous_threads) == 0
+  and (
+    any(ml.nlu_classifier(body.current_thread.text).entities, .name == "greeting")
+    or strings.ilike(body.current_thread.text, "*hi*", "*hello*", "*hey*")
+    or length(body.current_thread.text) <= 5
+    or regex.match(body.current_thread.text, '\d+')
+  )
+  // external freemail sender
+  and sender.email.domain.root_domain in $free_email_providers
+  and sender.email.domain.root_domain not in (
+    recipients.to[0].email.domain.root_domain
+  )
+  and (
+    length(recipients.cc) == 0
+    or (
+      length(recipients.cc) > 0
+      and all(recipients.cc,
+              .email.domain.root_domain != sender.email.domain.root_domain
+      )
+    )
+  )
+  and (
+    length(recipients.bcc) == 0
+    or (
+      length(recipients.bcc) > 0
+      and all(recipients.bcc,
+              .email.domain.root_domain != sender.email.domain.root_domain
+      )
+    )
+  )
+  // no attachments or links
+  and length(attachments) == 0
+  and length(body.current_thread.links) == 0
+  
+  // not where the sender and mailbox display_anames indicate this might be a personal email --> work email
+  // impersonation is covered by other core feed rules
+  and not (
+    sum([length(recipients.to), length(recipients.bcc), length(recipients.cc)]) == 1
+    and strings.icontains(sender.display_name, mailbox.first_name)
+    and strings.icontains(sender.display_name, mailbox.last_name)
+  )
+  and (
+    // auth failed (or absent) - ignore the profile
+    coalesce(headers.auth_summary.dmarc.pass, false) == false
+    or coalesce(headers.auth_summary.spf.pass, false) == false
+    // auth passed - use the profile
+    or (
+      // no benign messages
+      not profile.by_sender_email().any_messages_benign
+      and (
+        // not soliticed OR common
+        not (
+          profile.by_sender_email().solicited
+          or profile.by_sender_email().prevalence == "common"
+        )
+        // or HAS been spam_malicious
+        or profile.by_sender_email().any_messages_malicious_or_spam
+      )
+    )
+  )
+tags:
+ - "Attack surface reduction"
+attack_types:
+  - "BEC/Fraud"
+  - "Callback Phishing"
+tactics_and_techniques:
+  - "Social engineering"
+  - "Free email provider"
+detection_methods:
+  - "Content analysis"
+  - "Header analysis"
+  - "Natural Language Understanding"
+  - "Sender analysis"
+id: "ae1d7431-e73a-5f82-bca4-6beb570879f9"
+og_id: "c67dedab-91f5-5bbe-af81-f9895a02c065"
+testing_pr: 4566
+testing_sha: ede71fcf8480c7b7799522b852a8b2e50dca1330