Skip to content

Commit 78b4834

Browse files
github-actions[bot]github-actions[bot]
committed
[Test Rules] [PR #4369] added rule: Attachment: Suspicious employee policy update document lure
1 parent f575694 commit 78b4834

1 file changed

Lines changed: 163 additions & 0 deletions

File tree

‎detection-rules/4369_attachment_sus_employee_doc.yml‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
name: "Attachment: Suspicious employee policy update document lure"
2+
description: "Inbound message containing subject line and attachments related to handbook, compensation, or policy updates. Attachments are limited to Microsoft Word documents and match similar update-related terminology. This pattern has been observed used to delivery credential phishing via QR codes."
3+
type: "rule"
4+
severity: "medium"
5+
source: |
6+
type.inbound
7+
// NOTE: mirror ALL changes between subject & attachments
8+
and (
9+
// the subject contains pay related keywords
10+
(
11+
(
12+
strings.icontains(subject.base, "benefits")
13+
and not strings.icontains(subject.base, "fidelity netbenefits")
14+
)
15+
or strings.icontains(subject.base, "bonus")
16+
or (
17+
regex.icontains(subject.base, '\bcomp(?:ensation)?\b')
18+
and not strings.icontains(subject.base, "broker")
19+
)
20+
or strings.icontains(subject.base, "earnings")
21+
or regex.icontains(subject.base, 'empl[o0]y(?:ment|ee)')
22+
or (
23+
strings.icontains(subject.base, "financial")
24+
and not strings.icontains(subject.base, "statement")
25+
)
26+
or strings.icontains(subject.base, "handbook")
27+
or strings.icontains(subject.base, "incentive")
28+
or regex.icontains(subject.base, 'merit\b')
29+
or regex.icontains(subject.base, '\bpay(?:out|roll)?\b')
30+
or strings.icontains(subject.base, "remuneration")
31+
or strings.icontains(subject.base, "salary")
32+
)
33+
and (
34+
strings.icontains(subject.base, "access your")
35+
or regex.icontains(subject.base, 'adjust(?:ed|ment)')
36+
or regex.icontains(subject.base, 'amend(?:ed|ment)')
37+
or strings.icontains(subject.base, "appraisal")
38+
or strings.icontains(subject.base, "assessment")
39+
or strings.icontains(subject.base, "breakdown")
40+
or strings.icontains(subject.base, "change")
41+
or strings.icontains(subject.base, "details")
42+
or strings.icontains(subject.base, "distribution")
43+
or regex.icontains(subject.base, 'eval\b')
44+
or strings.icontains(subject.base, "evaluation")
45+
or strings.icontains(subject.base, "feedback")
46+
or strings.icontains(subject.base, "increase")
47+
or strings.icontains(subject.base, "increment")
48+
or strings.icontains(subject.base, "info")
49+
or strings.icontains(subject.base, "modification")
50+
or strings.icontains(subject.base, "notification")
51+
or strings.icontains(subject.base, "performance")
52+
or strings.icontains(subject.base, "plan")
53+
or strings.icontains(subject.base, "qualification")
54+
or strings.icontains(subject.base, "raise")
55+
or (
56+
strings.icontains(subject.base, "review")
57+
and not strings.icontains(subject.base, "preview")
58+
)
59+
or regex.icontains(subject.base, 'revis(?:ed|ion)')
60+
or strings.icontains(subject.base, "statement")
61+
or regex.icontains(subject.base, 'update(?:d| to)?')
62+
or regex.icontains(subject.base,
63+
'(January|February|March|April|May|June|July|August|September|October|November|December)\s20[2,3]{1}\d{1}'
64+
)
65+
)
66+
)
67+
68+
// the attachment contains pay related keywords
69+
and 0 < length(attachments) <= 3
70+
and any(attachments,
71+
.file_type in ("doc", "docx", "pdf", "pptx")
72+
and (
73+
(
74+
strings.icontains(.file_name, "benefits")
75+
and not strings.icontains(.file_name, "fidelity netbenefits")
76+
)
77+
or strings.icontains(.file_name, "bonus")
78+
or (
79+
regex.icontains(.file_name, '\bcomp(?:ensation)?\b')
80+
and not (strings.icontains(.file_name, "broker"))
81+
)
82+
or regex.icontains(.file_name, 'empl[o0]y(?:ment|ee)')
83+
or (
84+
strings.icontains(.file_name, "financial")
85+
and not strings.icontains(.file_name, "statement")
86+
)
87+
or strings.icontains(.file_name, "handbook")
88+
or strings.icontains(.file_name, "incentive")
89+
or regex.icontains(.file_name, 'merit\b')
90+
or regex.icontains(.file_name, '\bpay(?:out|roll)?\b')
91+
or strings.icontains(.file_name, "remuneration")
92+
or strings.icontains(.file_name, "salary")
93+
)
94+
and (
95+
strings.icontains(.file_name, "access your")
96+
or regex.icontains(.file_name, 'adjust(?:ed|ment)')
97+
or regex.icontains(.file_name, 'amend(?:ed|ment)')
98+
or strings.icontains(.file_name, "appraisal")
99+
or strings.icontains(.file_name, "assessment")
100+
or strings.icontains(.file_name, "breakdown")
101+
or strings.icontains(.file_name, "change")
102+
or strings.icontains(.file_name, "details")
103+
or strings.icontains(.file_name, "distribution")
104+
or regex.icontains(.file_name, 'eval\b')
105+
or strings.icontains(.file_name, "evaluation")
106+
or strings.icontains(.file_name, "feedback")
107+
or strings.icontains(.file_name, "increase")
108+
or strings.icontains(.file_name, "increment")
109+
or strings.icontains(.file_name, "info")
110+
or strings.icontains(.file_name, "modification")
111+
or strings.icontains(.file_name, "notification")
112+
or strings.icontains(.file_name, "performance")
113+
or strings.icontains(.file_name, "plan")
114+
or strings.icontains(.file_name, "qualification")
115+
or strings.icontains(.file_name, "raise")
116+
or (
117+
strings.icontains(.file_name, "review")
118+
and not strings.icontains(.file_name, "preview")
119+
)
120+
or regex.icontains(.file_name, 'revis(?:ed|ion)')
121+
or strings.icontains(.file_name, "statement")
122+
or regex.icontains(.file_name, 'update(?:d| to)?')
123+
or regex.icontains(.file_name,
124+
'(January|February|March|April|May|June|July|August|September|October|November|December)\s20[2,3]{1}\d{1}'
125+
)
126+
or (
127+
// file name contains recipient's email
128+
any(recipients.to,
129+
strings.icontains(..file_name, .email.email)
130+
and .email.domain.valid
131+
)
132+
// file name contains recipient's sld
133+
or any(recipients.to,
134+
strings.icontains(..file_name, .email.domain.sld)
135+
and .email.domain.valid
136+
)
137+
)
138+
)
139+
)
140+
141+
// negate legitimate conversations
142+
and not (subject.is_forward or subject.is_reply)
143+
144+
// negate high trust sender domains unless they fail authentication
145+
and not (
146+
sender.email.domain.root_domain in $high_trust_sender_root_domains
147+
and coalesce(headers.auth_summary.dmarc.pass, false)
148+
)
149+
150+
attack_types:
151+
- "Credential Phishing"
152+
tactics_and_techniques:
153+
- "PDF"
154+
- "Social engineering"
155+
- "Evasion"
156+
detection_methods:
157+
- "Content analysis"
158+
- "File analysis"
159+
- "Sender analysis"
160+
id: "1fec6756-a98a-5777-b7e4-ffa803a906a9"
161+
og_id: "a8bf1fd1-d9fa-572d-8957-51d6025a5248"
162+
testing_pr: 4369
163+
testing_sha: f2bf594f1df53f0ea6aae79fb1b00d60aaaea702

0 commit comments

Comments
 (0)