sublimelowRule

Spam: Spoofed Outlook mailer with unsubscribe and reference ID footer

Flags inbound messages that spoof the Microsoft Outlook mailer header while containing an 'unsubscribe here' link followed by an alphanumeric reference ID pattern in the body text, a common tactic used to lend spam messages an air of legitimacy. Highly trusted sender domains are excluded from this rule when they pass DMARC authentication.

MITRE ATT&CK

T1566 T1598

initial-access

Detection Query

type.inbound
and strings.istarts_with(headers.mailer, 'Microsoft Outlook')
and regex.icontains(body.current_thread.text,
                    'unsubscribe here[\s\S]{0,120}?reference\s?id:\s*[a-z0-9]{6,}'
)

// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

Raw Content

name: "Spam: Spoofed Outlook mailer with unsubscribe and reference ID footer"
description: "Flags inbound messages that spoof the Microsoft Outlook mailer header while containing an 'unsubscribe here' link followed by an alphanumeric reference ID pattern in the body text, a common tactic used to lend spam messages an air of legitimacy. Highly trusted sender domains are excluded from this rule when they pass DMARC authentication."
type: "rule"
severity: "low"
source: |
  type.inbound
  and strings.istarts_with(headers.mailer, 'Microsoft Outlook')
  and regex.icontains(body.current_thread.text,
                      'unsubscribe here[\s\S]{0,120}?reference\s?id:\s*[a-z0-9]{6,}'
  )
  
  // negate highly trusted sender domains unless they fail DMARC authentication
  and not (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and coalesce(headers.auth_summary.dmarc.pass, false)
  )
attack_types:
  - "Spam"
tactics_and_techniques:
  - "Social engineering"
  - "Spoofing"
detection_methods:
  - "Content analysis"
  - "Header analysis"
id: "5257f3dd-8c5f-50c7-a987-89379dfc4e40"