[Shared Samples] [PR #4529] added rule: PR# 4529 - Self-sender with suspicious links (French/Français)

Author: github-actions[bot]

detection-rules/4529_self_sender_french_copypaste_instructions_suspicious_domains.yml

@@ -0,0 +1,38 @@
+name: "PR# 4529 - Self-sender with suspicious links (French/Français)"
+description: "Detects messages where the sender emails themselves with French text containing 'copier' (copy) and 'coller' (paste) instructions, along with suspicious domains like pages.dev or web.app. The subject line contains both the sender's email and display name, which are different values."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  // message is in French
+  and ml.nlu_classifier(body.current_thread.text).language == 'french'
+  // self sender
+  and (
+    length(recipients.to) == 1
+    and length(recipients.cc) == 0
+    and sender.email.email in map(recipients.to, .email.email)
+  )
+  and strings.icontains(subject.subject, sender.email.email)
+  and strings.icontains(subject.subject, sender.display_name)
+  and sender.email.email != sender.display_name
+  and (
+    strings.contains(body.current_thread.text, '.pages.dev')
+    or strings.contains(body.current_thread.text, '.web.app')
+  )
+attack_types:
+  - "Credential Phishing"
+tactics_and_techniques:
+  - "Evasion"
+  - "Free subdomain host"
+  - "Social engineering"
+detection_methods:
+  - "Content analysis"
+  - "Header analysis"
+  - "Sender analysis"
+id: "5c57092c-9449-57ca-9631-3daa572b85d8"
+tags:
+  - created_from_open_prs
+  - rule_status_modified
+  - pr_author_peterdj45
+references:
+  - https://github.com/sublime-security/sublime-rules/pull/4529