Credential theft with 'safe content' deception and social engineering topics

name: "Credential theft with 'safe content' deception and social engineering topics"
description: "Detects messages containing credential theft language combined with social engineering topics like secure messages, notifications, or authentication alerts. The rule specifically identifies emails that deceptively claim to be from a 'safe sender' or contain 'safe content' in the first line, which is a common tactic used to bypass security filters and gain user trust."
type: "rule"
severity: "medium"
source: |
  type.inbound
  and any(ml.nlu_classifier(body.current_thread.text).intents,
          .name == "cred_theft" and .confidence != "low"
  )
  and (
    any(ml.nlu_classifier(body.current_thread.text).topics,
        .name in (
          "Reminders and Notifications",
          "Secure Message",
          "Security and Authentication",
          "Voicemail Call and Missed Call Notifications",
          "E-Signature",
          "Financial Communications"
        )
    )
    or (
      length(distinct(filter(ml.nlu_classifier(body.current_thread.text).entities,
                             .name not in ("org", "recipient", "sender")
                      ),
                      .name
             )
      ) > 0
      and all(distinct(filter(ml.nlu_classifier(body.current_thread.text).entities,
                              .name not in ("org", "recipient", "sender")
                       ),
                       .name
              ),
              .name in ("request", "financial", "urgency")
      )
    )
  )
  and not any(ml.nlu_classifier(body.current_thread.text).topics,
              .name in (
                "Advertising and Promotions",
                "Newsletters and Digests",
                "News and Current Events",
                "Travel and Transportation"
              )
  )
  // check only the first line of the email
  and any(regex.iextract(body.current_thread.text, "^[^\r\n]*"),
          length(.full_match) < 500
          and strings.ilike(strings.replace_confusables(.full_match),
                            "*safe content*",
                            "*safe sender*",
                            "*trusted sender*"
          )
          and not regex.icontains(.full_match,
                                  "add.{0,50} to.{0,50}(address book|safe senders? list)"
          )
  )

attack_types:
  - "Credential Phishing"
tactics_and_techniques:
  - "Social engineering"
  - "Evasion"
detection_methods:
  - "Content analysis"
  - "Natural Language Understanding"
id: "22ceee0d-1641-5f25-9034-a29b3fdade3d"